lumma | e34f332c700bebc0bebcfade306bda370c4057a3da405fcbc7ce2c2638babe34

Analysis

max time kernel
1036s
max time network
1038s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
27-11-2024 15:44

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

goat-simulator-remastered-cheat-engine.html
Size

39KB
MD5

e395667f9d8ca6e86a2842b64539a421
SHA1

c438c4602fdede71e1868bb58c1891477de468df
SHA256

e34f332c700bebc0bebcfade306bda370c4057a3da405fcbc7ce2c2638babe34
SHA512

38a3f000863874338d895eeae219889c3a7290f631e40707880a78adaa79cfaa283ec35b521f47610cc3d604d94b03d73bef5495066e7d9400ac18d10737a1c1
SSDEEP

384:fOtIbsiy1EfQnID5wfjqScr6cLQ6wn/gACKdy1UdiseK1iGAK9Ffw9xKJEa8SFwc:fOBhg9UdrX5BJ/2rZhmcihCrourK

Score

10^/10

lumma microsoft defense_evasion discovery evasion execution persistence phishing privilege_escalation stealer trojan

Malware Config

Extracted

Family

lumma

https://powerful-avoids.sbs

https://motion-treesz.sbs

https://disobey-curly.sbs

https://leg-sate-boat.sbs

https://story-tense-faz.sbs

https://blade-govern.sbs

https://occupy-blushi.sbs

https://frogs-severz.sbs

https://sapphirelake.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: comments-ui@~0.22
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: httpswww.mediafire.comfileu557auvh8a9v4w5@Paw0rD39710peC9B4SetUE1B498
phishing
A potential corporate email address has been identified in the URL: httpswww.mediafire.comfileu557auvh8a9v4w5@Paw0rD39710peSetU
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: portal@~2.46
phishing
A potential corporate email address has been identified in the URL: sodo-search@~1.5
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 51 IoCs

pid	Process
3436	7z2408-x64.exe
5360	7zG.exe
5464	7zG.exe
3432	Set-up.exe
5508	Set-up.exe
5824	7zG.exe
5692	CheatEngine75.exe
1824	CheatEngine75.tmp
4056	CheatEngine75.exe
5628	CheatEngine75.tmp
5932	_setup64.tmp
2384	Kernelmoduleunloader.exe
2524	windowsrepair.exe
5708	Cheat Engine.exe
5188	cheatengine-x86_64-SSE4-AVX2.exe
708	Cheat Engine.exe
3476	cheatengine-x86_64-SSE4-AVX2.exe
5552	Cheat Engine.exe
5336	cheatengine-x86_64-SSE4-AVX2.exe
6136	7zFM.exe
5572	RobloxPlayerInstaller.exe
5584	MicrosoftEdgeWebview2Setup.exe
7400	MicrosoftEdgeUpdate.exe
7444	MicrosoftEdgeUpdate.exe
5884	MicrosoftEdgeUpdate.exe
6876	MicrosoftEdgeUpdateComRegisterShell64.exe
7000	MicrosoftEdgeUpdateComRegisterShell64.exe
6700	MicrosoftEdgeUpdateComRegisterShell64.exe
7040	MicrosoftEdgeUpdate.exe
6792	MicrosoftEdgeUpdate.exe
2336	MicrosoftEdgeUpdate.exe
8628	MicrosoftEdgeUpdate.exe
1328	MicrosoftEdge_X64_131.0.2903.70.exe
7736	setup.exe
5812	setup.exe
6336	cheatengine-x86_64.exe
7408	MicrosoftEdgeUpdate.exe
6684	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe
6952	RobloxPlayerBeta.exe
4620	MicrosoftEdgeUpdate.exe
5692	MicrosoftEdgeUpdate.exe
6968	MicrosoftEdgeUpdateSetup_X86_1.3.195.39.exe
7024	MicrosoftEdgeUpdate.exe
6536	MicrosoftEdgeUpdate.exe
860	MicrosoftEdgeUpdate.exe
8148	MicrosoftEdgeUpdate.exe
5124	MicrosoftEdgeUpdateComRegisterShell64.exe
8104	MicrosoftEdgeUpdateComRegisterShell64.exe
8268	MicrosoftEdgeUpdateComRegisterShell64.exe
8824	MicrosoftEdgeUpdate.exe

Loads dropped DLL 64 IoCs

pid	Process
3388	Process not Found
3388	Process not Found
5360	7zG.exe
5464	7zG.exe
3432	Set-up.exe
3432	Set-up.exe
3432	Set-up.exe
3432	Set-up.exe
3432	Set-up.exe
3432	Set-up.exe
3432	Set-up.exe
3432	Set-up.exe
3432	Set-up.exe
3432	Set-up.exe
3432	Set-up.exe
3432	Set-up.exe
3432	Set-up.exe
3432	Set-up.exe
3432	Set-up.exe
3432	Set-up.exe
3432	Set-up.exe
3432	Set-up.exe
3432	Set-up.exe
3432	Set-up.exe
3432	Set-up.exe
3432	Set-up.exe
3432	Set-up.exe
5508	Set-up.exe
5508	Set-up.exe
5508	Set-up.exe
5508	Set-up.exe
5508	Set-up.exe
5508	Set-up.exe
5508	Set-up.exe
5508	Set-up.exe
5508	Set-up.exe
5508	Set-up.exe
5508	Set-up.exe
5508	Set-up.exe
5508	Set-up.exe
5508	Set-up.exe
5508	Set-up.exe
5508	Set-up.exe
5508	Set-up.exe
5508	Set-up.exe
5508	Set-up.exe
5508	Set-up.exe
5824	7zG.exe
1824	CheatEngine75.tmp
5188	cheatengine-x86_64-SSE4-AVX2.exe
5188	cheatengine-x86_64-SSE4-AVX2.exe
5188	cheatengine-x86_64-SSE4-AVX2.exe
5188	cheatengine-x86_64-SSE4-AVX2.exe
5188	cheatengine-x86_64-SSE4-AVX2.exe
5188	cheatengine-x86_64-SSE4-AVX2.exe
5188	cheatengine-x86_64-SSE4-AVX2.exe
3476	cheatengine-x86_64-SSE4-AVX2.exe
3476	cheatengine-x86_64-SSE4-AVX2.exe
3476	cheatengine-x86_64-SSE4-AVX2.exe
3476	cheatengine-x86_64-SSE4-AVX2.exe
3476	cheatengine-x86_64-SSE4-AVX2.exe
3476	cheatengine-x86_64-SSE4-AVX2.exe
3476	cheatengine-x86_64-SSE4-AVX2.exe
5336	cheatengine-x86_64-SSE4-AVX2.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4760	icacls.exe
2756	icacls.exe

Blocklisted process makes network request 5 IoCs

flow	pid	Process
121	4488	msiexec.exe
122	4488	msiexec.exe
123	4488	msiexec.exe
124	5848	msiexec.exe
125	5848	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SystemSettingsAdminFlows.exe

Checks system information in the registry 2 TTPs 18 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\KERNEL32.DLL	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\uxtheme.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\imm32.dll	cheatengine-x86_64.exe
File opened for modification	C:\Windows\SYSTEM32\apphelp.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\ucrtbase.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\SHLWAPI.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\msimg32.dll	cheatengine-x86_64.exe
File opened for modification	C:\Windows\SYSTEM32\opengl32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\KERNEL32.DLL	cheatengine-x86_64.exe
File opened for modification	C:\Windows\System32\msvcp_win.dll	cheatengine-x86_64.exe
File opened for modification	C:\Windows\System32\psapi.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\psapi.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\clbcatq.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\sechost.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\clbcatq.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\oleaut32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\sechost.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\shell32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\wsock32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\winmm.dll	cheatengine-x86_64.exe
File opened for modification	C:\Windows\SYSTEM32\wintypes.dll	cheatengine-x86_64.exe
File opened for modification	C:\Windows\System32\user32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\winmm.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\hhctrl.ocx	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\MSCTF.dll	cheatengine-x86_64.exe
File opened for modification	C:\Windows\System32\msvcrt.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\wininet.dll	cheatengine-x86_64.exe
File opened for modification	C:\Windows\SYSTEM32\GLU32.dll	cheatengine-x86_64.exe
File opened for modification	C:\Windows\SYSTEM32\wintypes.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\user32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\win32u.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\msimg32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\user32.dll	cheatengine-x86_64.exe
File opened for modification	C:\Windows\SYSTEM32\wintypes.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\ucrtbase.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\imm32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\wininet.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\hhctrl.ocx	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\GLU32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\explorerframe.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\MSCTF.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\ntdll.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\apphelp.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\uxtheme.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\GDI32.dll	cheatengine-x86_64.exe
File opened for modification	C:\Windows\system32\explorerframe.dll	cheatengine-x86_64.exe
File opened for modification	C:\Windows\System32\gdi32full.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\shcore.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\psapi.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\user32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\ws2_32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\MSCTF.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\KERNEL32.DLL	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\combase.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\kernel.appcore.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\GDI32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\shell32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\wsock32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\windows.storage.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\combase.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\imm32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\comdlg32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\wintypes.dll	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\advapi32.dll	cheatengine-x86_64-SSE4-AVX2.exe

Suspicious use of NtCreateThreadExHideFromDebugger 3 IoCs

pid	Process
6684	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe
6952	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 63 IoCs

pid	Process
6684	RobloxPlayerBeta.exe
6684	RobloxPlayerBeta.exe
6684	RobloxPlayerBeta.exe
6684	RobloxPlayerBeta.exe
6684	RobloxPlayerBeta.exe
6684	RobloxPlayerBeta.exe
6684	RobloxPlayerBeta.exe
6684	RobloxPlayerBeta.exe
6684	RobloxPlayerBeta.exe
6684	RobloxPlayerBeta.exe
6684	RobloxPlayerBeta.exe
6684	RobloxPlayerBeta.exe
6684	RobloxPlayerBeta.exe
6684	RobloxPlayerBeta.exe
6684	RobloxPlayerBeta.exe
6684	RobloxPlayerBeta.exe
6684	RobloxPlayerBeta.exe
6684	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe
6952	RobloxPlayerBeta.exe
6952	RobloxPlayerBeta.exe
6952	RobloxPlayerBeta.exe
6952	RobloxPlayerBeta.exe
6952	RobloxPlayerBeta.exe
6952	RobloxPlayerBeta.exe
6952	RobloxPlayerBeta.exe
6952	RobloxPlayerBeta.exe
6952	RobloxPlayerBeta.exe
6952	RobloxPlayerBeta.exe
6952	RobloxPlayerBeta.exe
6952	RobloxPlayerBeta.exe
6952	RobloxPlayerBeta.exe
6952	RobloxPlayerBeta.exe
6952	RobloxPlayerBeta.exe
6952	RobloxPlayerBeta.exe
6952	RobloxPlayerBeta.exe
6952	RobloxPlayerBeta.exe
6952	RobloxPlayerBeta.exe
6952	RobloxPlayerBeta.exe
6952	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe
6684	RobloxPlayerBeta.exe
6684	RobloxPlayerBeta.exe
6684	RobloxPlayerBeta.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3432 set thread context of 2268	3432	Set-up.exe	102
PID 5508 set thread context of 5720	5508	Set-up.exe	106

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Cheat Engine 7.5\ws2_32.pdb	cheatengine-x86_64.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU17FF.tmp\MicrosoftEdgeUpdateCore.exe	MicrosoftEdgeUpdateSetup_X86_1.3.195.39.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\symbols\dll\ws2_32.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\GuiImagePlaceholder.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\icon_intern-16.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ViewSelector\front_zh_cn.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-ingame-8x8.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\Properties\is-85KS2.tmp	CheatEngine75.tmp
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\StudioToolbox\AudioSoundEffect.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\StudioToolbox\AssetConfig\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\TixIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\Settings\MenuBarAssets\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\textures\ui\LuaApp\ExternalSite\youtube.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\identity_proxy\beta.identity_helper.exe.manifest	setup.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\dll\ole32.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\CompositorDebugger\default.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\MaterialManager\chevrons-right.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\Backpack_Open.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\avatar\meshes\leftarm.mesh	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\Locales\nn.pak	setup.exe
File created	C:\Program Files\Cheat Engine 7.5\is-9JP8J.tmp	CheatEngine75.tmp
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\identity_proxy\resources.pri	setup.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\symbols\dll\ucrtbase.pdb	cheatengine-x86_64.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\DLL\kernel32.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\VoiceChat\MicDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\VisualElements\LogoCanary.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA586.tmp\msedgeupdateres_es.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-OJM0M.tmp	CheatEngine75.tmp
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\AnimationEditor\img_key_indicator_selected_border.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\StudioToolbox\AssetConfig\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\TerrainTools\icon_regions_paste.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\StudioToolbox\Banners\MonsterCat.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\VoiceChat\MicDark\Unmuted40.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\VoiceChat\MicDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\msedge_100_percent.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Locales\ro.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\Locales\as.pak	setup.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\devobj.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\dll\winhttp.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\textures\ui\InGameMenu\drop_shadow_favorite.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Locales\ug.pak	setup.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\symbols\dll\user32.pdb	cheatengine-x86_64.exe
File created	C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-SDPOI.tmp	CheatEngine75.tmp
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\avatar\characterR15.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\Settings\Help\AButtonLight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\symbols\dll\TextShaping.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Program Files\Cheat Engine 7.5\CoreMessaging.pdb	cheatengine-x86_64-SSE4-AVX2.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\Debugger\debugger_arrow_curve_left.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\DeveloperFramework\AudioPlayer\audioPlay_BG.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File created	C:\Windows\Logs\PBR\Panther\_s_3569.tmp	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\DDACLSys.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\SessionID.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\Logs\PBR\INF\setupapi.offline.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\cbs_intl.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\UnattendGC	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\MainQueueOnline1.que	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\unattend.xml	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\_s_33B3.tmp	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\ResetSession.xml	SystemSettingsAdminFlows.exe
File created	C:\Windows\SystemTemp\762fab58-0557-4c14-82d6-f3684de33e5b.tmp	setup.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\UnattendGC\setupact.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\PushButtonReset.etl	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\SessionID.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\BCDCopy.LOG	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\CBS\CbsPersist_20241007123208.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\Contents1.dir	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\WinRE\bootstat.dat	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\setuperr.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\setupact.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\WinRE\bootstat.dat	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\CBS\CBS.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\UnattendGC\setupact.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\diagerr.xml	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\UnattendGC\setuperr.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Timestamp.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\Logs\PBR\DISM	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\actionqueue\specialize.uaq	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\cbs_unattend.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\UnattendGC\diagerr.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\UnattendGC\diagerr.xml	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\cbs.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\Logs\PBR\INF\setupapi.dev.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\_s_3701.tmp	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\BCDCopy	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\diagerr.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\diagwrn.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\_s_3569.tmp	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\PushButtonReset.etl	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\INF\setupapi.setup.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\CBS\CbsPersist_20241007123208.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\Contents0.dir	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22000.120_none_9d947278b86cc467\comctl32.dll	cheatengine-x86_64-SSE4-AVX2.exe
File created	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Windows\Logs\PBR\Timestamp.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\BCDCopy	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Logs\PBR\DISM\dism.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\cbs.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\setupact.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22000.120_none_9d947278b86cc467\comctl32.dll	cheatengine-x86_64.exe
File created	C:\Windows\Logs\PBR\INF\setupapi.dev.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\DDACLSys.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\UnattendGC\diagwrn.xml	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\cbs_unattend.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\MainQueueOnline0.que	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3172	sc.exe
6096	sc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\7z2408-x64.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\CheatEngine75.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheatEngine75.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheatEngine75.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheatEngine75.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kernelmoduleunloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cheat Engine.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheatEngine75.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdateSetup_X86_1.3.195.39.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2408-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cheat Engine.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsrepair.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	more.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	more.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cheat Engine.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
7408	MicrosoftEdgeUpdate.exe
7024	MicrosoftEdgeUpdate.exe
8824	MicrosoftEdgeUpdate.exe
7040	MicrosoftEdgeUpdate.exe
8628	MicrosoftEdgeUpdate.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CheatEngine75.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	CheatEngine75.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ = "IAppBundle"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{C7931E4D-82F7-486C-9FFB-E44AB90B021F}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass.1\CLSID\ = "{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32\ = "{C7931E4D-82F7-486C-9FFB-E44AB90B021F}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32\ = "{C7931E4D-82F7-486C-9FFB-E44AB90B021F}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback\CLSID\ = "{77857D02-7A25-4B67-9266-3E122A8F39E4}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.39\\psmachine.dll"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7931E4D-82F7-486C-9FFB-E44AB90B021F}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods\ = "11"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\LocalService = "edgeupdate"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc\CLSID\ = "{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ = "IPolicyStatus4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback\CLSID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods\ = "23"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine\CLSID\ = "{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\Elevation	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback\CurVer\ = "MicrosoftEdgeUpdate.PolicyStatusMachineFallback.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods\ = "41"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\PROGID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass.1\CLSID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods\ = "8"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.39\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ = "IApp2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\PROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7931E4D-82F7-486C-9FFB-E44AB90B021F}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{42580F9E-2678-4BB9-A2BC-F22A1D432A1A}\InprocHandler32	MicrosoftEdgeUpdateComRegisterShell64.exe

NTFS ADS 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\7z2408-x64.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\CheatEngine75.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	firefox.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
3432	Set-up.exe
3432	Set-up.exe
3432	Set-up.exe
3432	Set-up.exe
3432	Set-up.exe
2268	more.com
2268	more.com
2268	more.com
2268	more.com
5508	Set-up.exe
5508	Set-up.exe
5508	Set-up.exe
5508	Set-up.exe
5508	Set-up.exe
5720	more.com
5720	more.com
5720	more.com
5720	more.com
1824	CheatEngine75.tmp
1824	CheatEngine75.tmp
1824	CheatEngine75.tmp
1824	CheatEngine75.tmp
1824	CheatEngine75.tmp
1824	CheatEngine75.tmp
1824	CheatEngine75.tmp
1824	CheatEngine75.tmp
5628	CheatEngine75.tmp
5628	CheatEngine75.tmp
5188	cheatengine-x86_64-SSE4-AVX2.exe
5188	cheatengine-x86_64-SSE4-AVX2.exe
3476	cheatengine-x86_64-SSE4-AVX2.exe
3476	cheatengine-x86_64-SSE4-AVX2.exe
5336	cheatengine-x86_64-SSE4-AVX2.exe
5336	cheatengine-x86_64-SSE4-AVX2.exe
5572	RobloxPlayerInstaller.exe
5572	RobloxPlayerInstaller.exe
7400	MicrosoftEdgeUpdate.exe
7400	MicrosoftEdgeUpdate.exe
7400	MicrosoftEdgeUpdate.exe
7400	MicrosoftEdgeUpdate.exe
7400	MicrosoftEdgeUpdate.exe
7400	MicrosoftEdgeUpdate.exe
6684	RobloxPlayerBeta.exe
6336	cheatengine-x86_64.exe
6336	cheatengine-x86_64.exe
6832	RobloxPlayerBeta.exe
6952	RobloxPlayerBeta.exe
4620	MicrosoftEdgeUpdate.exe
4620	MicrosoftEdgeUpdate.exe
4620	MicrosoftEdgeUpdate.exe
4620	MicrosoftEdgeUpdate.exe
5692	MicrosoftEdgeUpdate.exe
5692	MicrosoftEdgeUpdate.exe
6536	MicrosoftEdgeUpdate.exe
6536	MicrosoftEdgeUpdate.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1608	OpenWith.exe
6136	7zFM.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
656	Process not Found

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3432	Set-up.exe
2268	more.com
5508	Set-up.exe
5720	more.com

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	3436	7z2408-x64.exe
Token: SeDebugPrivilege	3436	7z2408-x64.exe
Token: SeDebugPrivilege	3436	7z2408-x64.exe
Token: SeDebugPrivilege	3436	7z2408-x64.exe
Token: SeDebugPrivilege	3436	7z2408-x64.exe
Token: SeRestorePrivilege	5360	7zG.exe
Token: 35	5360	7zG.exe
Token: SeSecurityPrivilege	5360	7zG.exe
Token: SeSecurityPrivilege	5360	7zG.exe
Token: SeRestorePrivilege	5464	7zG.exe
Token: 35	5464	7zG.exe
Token: SeSecurityPrivilege	5464	7zG.exe
Token: SeSecurityPrivilege	5464	7zG.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeRestorePrivilege	5824	7zG.exe
Token: 35	5824	7zG.exe
Token: SeSecurityPrivilege	5824	7zG.exe
Token: SeSecurityPrivilege	5824	7zG.exe
Token: SeDebugPrivilege	1824	CheatEngine75.tmp
Token: SeDebugPrivilege	1824	CheatEngine75.tmp
Token: SeDebugPrivilege	1824	CheatEngine75.tmp
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp
Token: SeDebugPrivilege	5628	CheatEngine75.tmp

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
5360	7zG.exe
5464	7zG.exe
5824	7zG.exe
5628	CheatEngine75.tmp
1824	CheatEngine75.tmp
5188	cheatengine-x86_64-SSE4-AVX2.exe
3476	cheatengine-x86_64-SSE4-AVX2.exe
5336	cheatengine-x86_64-SSE4-AVX2.exe
6136	7zFM.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
6336	cheatengine-x86_64.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe

Suspicious use of SetWindowsHookEx 49 IoCs

pid	Process
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
3436	7z2408-x64.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
708	Cheat Engine.exe
3476	cheatengine-x86_64-SSE4-AVX2.exe
1608	OpenWith.exe
5552	Cheat Engine.exe
5336	cheatengine-x86_64-SSE4-AVX2.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
6108	MiniSearchHost.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
2336	SystemSettingsAdminFlows.exe
7192	LogonUI.exe

Suspicious use of UnmapMainImage 3 IoCs

pid	Process
6684	RobloxPlayerBeta.exe
6832	RobloxPlayerBeta.exe
6952	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 1384	3084	firefox.exe	77
PID 3084 wrote to memory of 1384	3084	firefox.exe	77
PID 3084 wrote to memory of 1384	3084	firefox.exe	77
PID 3084 wrote to memory of 1384	3084	firefox.exe	77
PID 3084 wrote to memory of 1384	3084	firefox.exe	77
PID 3084 wrote to memory of 1384	3084	firefox.exe	77
PID 3084 wrote to memory of 1384	3084	firefox.exe	77
PID 3084 wrote to memory of 1384	3084	firefox.exe	77
PID 3084 wrote to memory of 1384	3084	firefox.exe	77
PID 3084 wrote to memory of 1384	3084	firefox.exe	77
PID 3084 wrote to memory of 1384	3084	firefox.exe	77
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 3600	1384	firefox.exe	78
PID 1384 wrote to memory of 5080	1384	firefox.exe	79
PID 1384 wrote to memory of 5080	1384	firefox.exe	79
PID 1384 wrote to memory of 5080	1384	firefox.exe	79
PID 1384 wrote to memory of 5080	1384	firefox.exe	79
PID 1384 wrote to memory of 5080	1384	firefox.exe	79
PID 1384 wrote to memory of 5080	1384	firefox.exe	79
PID 1384 wrote to memory of 5080	1384	firefox.exe	79
PID 1384 wrote to memory of 5080	1384	firefox.exe	79

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\goat-simulator-remastered-cheat-engine.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\goat-simulator-remastered-cheat-engine.html
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1920 -prefMapHandle 1912 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5b66133-250a-44aa-ab41-68cb98508ab4} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" gpu
    3⤵
    PID:3600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f491cfc4-1930-438a-af66-6d1d3b44e083} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" socket
    3⤵
    PID:5080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3224 -childID 1 -isForBrowser -prefsHandle 3216 -prefMapHandle 3212 -prefsLen 24739 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3a2fa5c-713c-4036-9288-352c7a69c297} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:4688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3664 -childID 2 -isForBrowser -prefsHandle 3656 -prefMapHandle 3652 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {11013d18-29b9-4663-9974-bcedba22aca8} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:4716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4308 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4300 -prefMapHandle 4296 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {74a180e6-4004-401a-acb0-003ff5d844bf} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" utility
    3⤵
    - Checks processor information in registry
    PID:2696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5540 -childID 3 -isForBrowser -prefsHandle 5428 -prefMapHandle 5496 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d87c8ae-d81c-485a-8186-c9a860d97da9} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:4468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5684 -childID 4 -isForBrowser -prefsHandle 5688 -prefMapHandle 5692 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {39d31950-e479-4555-bc6b-fdb148f335d3} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:3996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5868 -childID 5 -isForBrowser -prefsHandle 5876 -prefMapHandle 5880 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0aa64e5-5913-476e-bcfc-1134a3428983} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:2932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4036 -childID 6 -isForBrowser -prefsHandle 4044 -prefMapHandle 4040 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {98f3053f-3a61-4555-a8e8-ec4112c0e0d1} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:3676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3292 -childID 7 -isForBrowser -prefsHandle 3280 -prefMapHandle 4060 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f5df6da-a2eb-42f5-a487-259a4f3178f1} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:4616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3220 -childID 8 -isForBrowser -prefsHandle 3268 -prefMapHandle 6312 -prefsLen 29355 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec19de93-e352-4faf-a8f3-9eabb4d190a2} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:4844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6480 -childID 9 -isForBrowser -prefsHandle 6472 -prefMapHandle 6468 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {62c95504-885f-440b-b58b-058b3e8f75a4} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:2088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6972 -childID 10 -isForBrowser -prefsHandle 7044 -prefMapHandle 6664 -prefsLen 27251 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {18f5e7c6-ee33-4b67-b21a-14c014c2092c} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:4396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7380 -childID 11 -isForBrowser -prefsHandle 7372 -prefMapHandle 7368 -prefsLen 28099 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5436d4b0-1ab8-47e0-8d2c-eb659cc7c480} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:1148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6424 -childID 12 -isForBrowser -prefsHandle 6160 -prefMapHandle 7444 -prefsLen 28099 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e207ab2-17f6-48ba-9113-4150bab027d1} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:2156
- - C:\Users\Admin\Downloads\7z2408-x64.exe
    "C:\Users\Admin\Downloads\7z2408-x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6640 -childID 13 -isForBrowser -prefsHandle 6680 -prefMapHandle 440 -prefsLen 28099 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad25c794-af27-4519-85af-8bafbd917b35} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:5672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6300 -childID 14 -isForBrowser -prefsHandle 6612 -prefMapHandle 7092 -prefsLen 28099 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {988e1131-fa1b-4607-aeb5-9f94d194542b} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:1016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6724 -childID 15 -isForBrowser -prefsHandle 7132 -prefMapHandle 7296 -prefsLen 28099 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fcafd531-a9bc-42dc-b3d7-1b413968dbb8} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:5528
- - C:\Users\Admin\Downloads\CheatEngine75.exe
    "C:\Users\Admin\Downloads\CheatEngine75.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5692
  - - C:\Users\Admin\AppData\Local\Temp\is-BIBET.tmp\CheatEngine75.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-BIBET.tmp\CheatEngine75.tmp" /SL5="$302BA,29027361,780800,C:\Users\Admin\Downloads\CheatEngine75.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\is-9VMT4.tmp\CheatEngine75.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-9VMT4.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4056
      - C:\Users\Admin\AppData\Local\Temp\is-VE20B.tmp\CheatEngine75.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-VE20B.tmp\CheatEngine75.tmp" /SL5="$1036C,26511452,832512,C:\Users\Admin\AppData\Local\Temp\is-9VMT4.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:5628
        
        C:\Windows\SYSTEM32\net.exe
        
        "net" stop BadlionAntic
        7⤵
        
        PID:1504
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop BadlionAntic
        8⤵
        
        PID:5340
        
        C:\Windows\SYSTEM32\net.exe
        
        "net" stop BadlionAnticheat
        7⤵
        
        PID:6028
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop BadlionAnticheat
        8⤵
        
        PID:2408
        
        C:\Windows\SYSTEM32\sc.exe
        
        "sc" delete BadlionAntic
        7⤵
        Launches sc.exe
        
        PID:3172
        
        C:\Windows\SYSTEM32\sc.exe
        
        "sc" delete BadlionAnticheat
        7⤵
        Launches sc.exe
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\is-5CMQD.tmp\_isetup\_setup64.tmp
        
        helper 105 0x3C0
        7⤵
        Executes dropped EXE
        
        PID:5932
        
        C:\Windows\SYSTEM32\icacls.exe
        
        "icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX)
        7⤵
        Modifies file permissions
        
        PID:4760
        
        C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe
        
        "C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe" /SETUP
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2384
        
        C:\Program Files\Cheat Engine 7.5\windowsrepair.exe
        
        "C:\Program Files\Cheat Engine 7.5\windowsrepair.exe" /s
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2524
        
        C:\Windows\SYSTEM32\icacls.exe
        
        "icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX)
        7⤵
        Modifies file permissions
        
        PID:2756
    - - C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe
        
        "C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5708
      - C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe
        
        "C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:5188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6524 -childID 16 -isForBrowser -prefsHandle 6280 -prefMapHandle 6540 -prefsLen 28099 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5b18068-c1e1-499a-b00a-73f6de9caa31} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:6000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6360 -childID 17 -isForBrowser -prefsHandle 6432 -prefMapHandle 7332 -prefsLen 28099 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9a15af8-3daa-42d3-b194-09a25495606d} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:5976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6972 -childID 18 -isForBrowser -prefsHandle 8044 -prefMapHandle 6248 -prefsLen 28099 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {14e12dce-04bf-4b45-81c0-e3d6b7106ae3} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:3024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7092 -childID 19 -isForBrowser -prefsHandle 6228 -prefMapHandle 7128 -prefsLen 28099 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {864aa17a-a985-4d00-939b-797296e94b14} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:4924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8572 -childID 20 -isForBrowser -prefsHandle 6296 -prefMapHandle 8500 -prefsLen 28099 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a1791ff-d6cb-47ba-8410-508322b72cb8} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:4284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6292 -childID 21 -isForBrowser -prefsHandle 6568 -prefMapHandle 8080 -prefsLen 28099 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {08d8efb6-6c9a-4607-a65e-35174a7c3737} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:5112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6484 -childID 22 -isForBrowser -prefsHandle 3624 -prefMapHandle 8900 -prefsLen 28099 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {75838353-ba39-4fe9-a34c-b1609860ee36} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:4692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8880 -parentBuildID 20240401114208 -prefsHandle 3332 -prefMapHandle 8784 -prefsLen 30682 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8c6b2ee-e03f-4bf1-98d1-c597a2805d74} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" rdd
    3⤵
    PID:1380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8932 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 8592 -prefMapHandle 8888 -prefsLen 30682 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e75ade3-8ffa-4c42-a5e8-634678c564ba} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" utility
    3⤵
    - Checks processor information in registry
    PID:1652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7664 -childID 23 -isForBrowser -prefsHandle 9572 -prefMapHandle 8768 -prefsLen 28149 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab46038e-f191-4923-ba4c-edf2d742c5a6} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:5176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8568 -childID 24 -isForBrowser -prefsHandle 8692 -prefMapHandle 6228 -prefsLen 28149 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {83eebea7-a909-4cbe-ab44-a40a31485a8c} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:6080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9732 -childID 25 -isForBrowser -prefsHandle 7648 -prefMapHandle 3628 -prefsLen 28149 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {42b5252e-3342-456c-962b-25e21884fe42} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:2976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10536 -childID 26 -isForBrowser -prefsHandle 10508 -prefMapHandle 10512 -prefsLen 28149 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f70ed971-3079-44b3-b13e-0b007fad57fb} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10800 -childID 27 -isForBrowser -prefsHandle 10700 -prefMapHandle 10704 -prefsLen 28149 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {547e680e-6560-48dc-ad94-d5beabf26db8} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:5508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10928 -childID 28 -isForBrowser -prefsHandle 10936 -prefMapHandle 10940 -prefsLen 28149 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {56f259f7-5d42-4c9d-b9e8-9e0004dea250} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:4188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10552 -childID 29 -isForBrowser -prefsHandle 11128 -prefMapHandle 11136 -prefsLen 28149 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {07ade5cd-66f3-4ab1-b8bb-b182e4e56a57} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:5924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=11356 -childID 30 -isForBrowser -prefsHandle 11364 -prefMapHandle 11368 -prefsLen 28149 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e1c5f634-5374-4429-b81d-4e406cb70c28} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:5732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=11468 -childID 31 -isForBrowser -prefsHandle 10928 -prefMapHandle 11448 -prefsLen 28149 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {888160ca-156d-4385-95ba-cf8e113ff88d} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:6692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=11672 -childID 32 -isForBrowser -prefsHandle 11680 -prefMapHandle 11684 -prefsLen 28149 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff3de166-bd5b-4e75-9958-0afda7cf3993} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:6756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=11908 -childID 33 -isForBrowser -prefsHandle 11812 -prefMapHandle 11820 -prefsLen 28149 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1bf77a63-ba38-4ffb-a1f1-22439626048d} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:6816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=11996 -childID 34 -isForBrowser -prefsHandle 12004 -prefMapHandle 12008 -prefsLen 28149 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b38bf931-50c7-4bcc-8ef7-c956cf0e5168} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:6860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=12204 -childID 35 -isForBrowser -prefsHandle 12212 -prefMapHandle 12216 -prefsLen 28149 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5db8382-237b-4d24-8204-780362d5cbbc} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:7084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=12312 -childID 36 -isForBrowser -prefsHandle 12452 -prefMapHandle 12456 -prefsLen 28149 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3aecec93-d3a4-456d-a6c6-737f45209c02} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:7136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=12464 -childID 37 -isForBrowser -prefsHandle 12640 -prefMapHandle 11456 -prefsLen 28149 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e485e778-92ff-4c07-adb2-281f57b910d1} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:6196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=12896 -childID 38 -isForBrowser -prefsHandle 12976 -prefMapHandle 12972 -prefsLen 28149 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {87f7315f-6591-4372-bea2-e22656869092} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:6280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=12868 -childID 39 -isForBrowser -prefsHandle 13216 -prefMapHandle 12204 -prefsLen 28149 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b9db876f-27b3-478e-89be-e71d9c92573e} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:5712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=12868 -childID 40 -isForBrowser -prefsHandle 13332 -prefMapHandle 13336 -prefsLen 28149 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a1bf486-b343-4966-a75f-25ff40d07d10} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:7628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=12500 -childID 41 -isForBrowser -prefsHandle 13156 -prefMapHandle 13152 -prefsLen 28149 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6fb46a92-4622-497f-bcba-ee9ad5b3c09b} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:7672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=11844 -childID 42 -isForBrowser -prefsHandle 12260 -prefMapHandle 12264 -prefsLen 28149 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d1a6a708-54e2-42be-a310-2561a8bd3694} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:7684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=12520 -childID 43 -isForBrowser -prefsHandle 12008 -prefMapHandle 12252 -prefsLen 28149 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e446d716-2e3e-4c5f-beba-76a42529a39d} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:7816
- - C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
    "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    PID:5572
  - - C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
      MicrosoftEdgeWebview2Setup.exe /silent /install
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:5584
    - - C:\Program Files (x86)\Microsoft\Temp\EUA586.tmp\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\Temp\EUA586.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
        5⤵
        Event Triggered Execution: Image File Execution Options Injection
        Executes dropped EXE
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:7400
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7444
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5884
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:6876
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:7000
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:6700
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjhFOTNFNEMtNjkwQy00NUU0LUFBQzYtRkZDN0NDQkNDMDE5fSIgdXNlcmlkPSJ7RTI1M0NGNzYtQ0Q4MS00Q0M0LTgyNDgtRDNGNzQ2QURBMTg2fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntEQzc5OTdGQy0yNzUzLTQ4OEUtQUNEMC0xNUY0RTBCRTBFRjB9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0My41NyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExMjc1NTY0NTg5IiBpbnN0YWxsX3RpbWVfbXM9IjQyMiIvPjwvYXBwPjwvcmVxdWVzdD4
        6⤵
        Executes dropped EXE
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:7040
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{68E93E4C-690C-45E4-AAC6-FFC7CCBCC019}" /silent
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6792
  - - C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\RobloxPlayerBeta.exe
      "C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\RobloxPlayerBeta.exe" -app -clientLaunchTimeEpochMs 0 -isInstallerLaunch 5572
      4⤵
      Executes dropped EXE
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of UnmapMainImage
      PID:6684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9920 -childID 44 -isForBrowser -prefsHandle 9688 -prefMapHandle 13388 -prefsLen 28393 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e55aa1e2-b07f-447a-80b1-02d2c8854d22} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:1936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4936 -childID 45 -isForBrowser -prefsHandle 10476 -prefMapHandle 10096 -prefsLen 28393 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8793890-4bce-4a13-a6bc-e3c88dc7d34c} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:8128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=12712 -childID 46 -isForBrowser -prefsHandle 10104 -prefMapHandle 11368 -prefsLen 28393 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4080bcc-c44f-4978-a69e-0460d0aae9ee} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" tab
    3⤵
    PID:6104

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5212

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\" -ad -an -ai#7zMap20522:120:7zEvent10546
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5360

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\" -an -ai#7zMap6063:178:7zEvent26530
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5464

C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\Set-up.exe
"C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\Set-up.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3432
- C:\Windows\SysWOW64\more.com
  C:\Windows\SysWOW64\more.com
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2268
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\SysWOW64\msiexec.exe
    3⤵
    - Blocklisted process makes network request
    - System Location Discovery: System Language Discovery
    PID:4488

C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\Set-up.exe
"C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\Set-up.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5508
- C:\Windows\SysWOW64\more.com
  C:\Windows\SysWOW64\more.com
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:5720
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\SysWOW64\msiexec.exe
    3⤵
    - Blocklisted process makes network request
    - System Location Discovery: System Language Discovery
    PID:5848

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\" -ad -an -ai#7zMap18920:178:7zEvent12819
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5824

C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe
"C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe" "C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\Resource.ct"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:708
- C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe
  "C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe" "C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\Resource.ct"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:3476

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1608
- C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe
  "C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe" "C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\Resource.ct"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5552
- - C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe
    "C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe" "C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\Resource.ct"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:5336

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\Resource.ct"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:6136

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:6108

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:4848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:6040

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:5764

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:8264

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:8928

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2336
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjhFOTNFNEMtNjkwQy00NUU0LUFBQzYtRkZDN0NDQkNDMDE5fSIgdXNlcmlkPSJ7RTI1M0NGNzYtQ0Q4MS00Q0M0LTgyNDgtRDNGNzQ2QURBMTg2fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntEQ0VFQTdCOC1GMTVBLTRCODUtQUNGNC03REQ3MDVFNTBDMDh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExMjc4ODU0NTU0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:8628
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{84DF3185-6CEF-40FB-94FE-926C70015559}\MicrosoftEdge_X64_131.0.2903.70.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{84DF3185-6CEF-40FB-94FE-926C70015559}\MicrosoftEdge_X64_131.0.2903.70.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:1328
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{84DF3185-6CEF-40FB-94FE-926C70015559}\EDGEMITMP_06F29.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{84DF3185-6CEF-40FB-94FE-926C70015559}\EDGEMITMP_06F29.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{84DF3185-6CEF-40FB-94FE-926C70015559}\MicrosoftEdge_X64_131.0.2903.70.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    PID:7736
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{84DF3185-6CEF-40FB-94FE-926C70015559}\EDGEMITMP_06F29.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{84DF3185-6CEF-40FB-94FE-926C70015559}\EDGEMITMP_06F29.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.86 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{84DF3185-6CEF-40FB-94FE-926C70015559}\EDGEMITMP_06F29.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.70 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff7b6a02918,0x7ff7b6a02924,0x7ff7b6a02930
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:5812
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjhFOTNFNEMtNjkwQy00NUU0LUFBQzYtRkZDN0NDQkNDMDE5fSIgdXNlcmlkPSJ7RTI1M0NGNzYtQ0Q4MS00Q0M0LTgyNDgtRDNGNzQ2QURBMTg2fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsyNDVBNENBMS02RkRDLTQ3MTktOTNDNC04Qjk0RTZFNDM4MTN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMzEuMC4yOTAzLjcwIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTI5MTkzNDQ0NSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExMjkxOTU0NDE2IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI5Mzc2ODcxNTUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzL2Y4MTM2OTAxLWM1ZjAtNDMyNi1iZjMzLTRkNzNiODdhMTk3OT9QMT0xNzMzMzI3NzM3JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PU5kcGY1Y3ZzJTJmWk9IZElsTHBlWW9OanpsTm45VG1Ra3Q5SEVURDFzdlh1JTJiSjd3V3RFM0hDOGdIWmNiWHhaUExacmV4RElFQm43Vld5QVpsUzZ5UGpuQSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE3NjYyMjE2MCIgdG90YWw9IjE3NjYyMjE2MCIgZG93bmxvYWRfdGltZV9tcz0iMTU3OTg2Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI5Mzg3NzcxNDIiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjk1MjY1NzE0NyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM1NTkyMzcyMDkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI5NDkiIGRvd25sb2FkX3RpbWVfbXM9IjE2NDY3NyIgZG93bmxvYWRlZD0iMTc2NjIyMTYwIiB0b3RhbD0iMTc2NjIyMTYwIiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI2MDY1NSIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:7408

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:4040

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3428

C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64.exe
"C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:6336

C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:6832

C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-8aa36bbf0eb1494a\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:6952

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:6436

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:7240

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4620

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5692
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7528EF86-F8BE-4C40-9895-6E00BD18D2D5}\MicrosoftEdgeUpdateSetup_X86_1.3.195.39.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7528EF86-F8BE-4C40-9895-6E00BD18D2D5}\MicrosoftEdgeUpdateSetup_X86_1.3.195.39.exe" /update /sessionid "{102D9AF9-0B23-4B94-87DF-87C75327638F}"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:6968
- - C:\Program Files (x86)\Microsoft\Temp\EU17FF.tmp\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\Temp\EU17FF.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{102D9AF9-0B23-4B94-87DF-87C75327638F}"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Checks system information in the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:6536
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:860
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:8148
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5124
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:8104
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:8268
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTAyRDlBRjktMEIyMy00Qjk0LTg3REYtODdDNzUzMjc2MzhGfSIgdXNlcmlkPSJ7RTI1M0NGNzYtQ0Q4MS00Q0M0LTgyNDgtRDNGNzQ2QURBMTg2fSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7QTI2RUM4RTgtRkZGNS00ODBDLUIwNUUtM0MzODAzQjY0M0QxfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3MS4zOSIgbmV4dHZlcnNpb249IjEuMy4xOTUuMzkiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzI3MjI5MzQiPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0ODY0Mjk5MTY2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
      4⤵
      Executes dropped EXE
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:8824
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTAyRDlBRjktMEIyMy00Qjk0LTg3REYtODdDNzUzMjc2MzhGfSIgdXNlcmlkPSJ7RTI1M0NGNzYtQ0Q4MS00Q0M0LTgyNDgtRDNGNzQ2QURBMTg2fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntFMjJCRUQwRC1CMjJELTQzOTQtOERGRC1EMkNGMUM0MjA4QjZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTcxLjM5IiBuZXh0dmVyc2lvbj0iMS4zLjE5NS4zOSIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0MzkzMzUwMTUwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0MzkzNTA2Mzg0IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNDgzMDUyNzkzMiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iZG8iIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzE3Yjc1MjIzLWEzNWUtNDQ0YS04MGQ0LWJiOTg5Y2NmMmY3Mz9QMT0xNzMzMzI4MDQ3JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PW1tandMbHY4UURjd0RpMGprSTYzeXowMW04VXBPeDlVemF3V0JIbmZTTWljQVBiNVlUNzI4bWxGbTF5NWFVeHRXNjNyb0EySkwwUW8zQ3M5OHVIVnN3JTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjciLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTQ4MzA1Mjc5MzIiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzE3Yjc1MjIzLWEzNWUtNDQ0YS04MGQ0LWJiOTg5Y2NmMmY3Mz9QMT0xNzMzMzI4MDQ3JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PW1tandMbHY4UURjd0RpMGprSTYzeXowMW04VXBPeDlVemF3V0JIbmZTTWljQVBiNVlUNzI4bWxGbTF5NWFVeHRXNjNyb0EySkwwUW8zQ3M5OHVIVnN3JTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTY1MzMyOCIgdG90YWw9IjE2NTMzMjgiIGRvd25sb2FkX3RpbWVfbXM9IjQzNjU1Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0ODMwNTI3OTMyIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0ODM1NzUyMjg4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PHBpbmcgcj0iLTEiIHJkPSItMSIvPjwvYXBwPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSI5MC4wLjgxOC42NiIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBsYXN0X2xhdW5jaF90aW1lPSIxMzM3Mjc3OTU0MDEyNDI0NzAiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSItMSIgcj0iLTEiIGFkPSItMSIgcmQ9Ii0xIi8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjEzMS4wLjI5MDMuNzAiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiB1cGRhdGVfY291bnQ9IjEiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iLTEiIHJkPSItMSIgcGluZ19mcmVzaG5lc3M9Ins4MjVFRkU4QS0zMEVELTQyNDItQUE4OS1GQjFFOTI4N0Y3N0Z9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:7024

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:6396

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" FeaturedResetPC
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2336

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:8648

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:8792

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:6660

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:9032

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa395b055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:7192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$SysReset\Logs\ResetConfig.ini

Filesize
167B

MD5
e8b67f9f170a171d59b1020f686f09ce

SHA1
19428a2ab0e7f64ceaf7cdc723916a9f6ebf26bd

SHA256
e88065016cfd248d4d0f5199becb3d9233a4d96bcb60fa5a7c2724c2cc71ac1d

SHA512
8616c3065e84f11acd8cbe57e3dc06fab843787ccccec062ec873ba7e97eeb6008cb61b2e35a71bbbdd61be800ad96af6a0dbbbcca42992ed2a5ee0681e156a8

Download Submit
C:\$SysReset\Logs\ResetConfig.ini

Filesize
186B

MD5
47069918e9e83eb02bff5ce5498c9bbd

SHA1
17ffee2e0ddfec27bba8c1a3550d57c7f92960d5

SHA256
e7688a4bb28fbb7b562886e29da34887d6189a52041de39b538d5c2caf3c932e

SHA512
7a0d2ed36988aa921e0e09779bb8defe38133c8f6add2159cceeee59f5083d391fea2f7bee961b5bba4767e75eea8a2670e7900290c17ce7cc80fae7e037a4c1

Download Submit
C:\$SysReset\Logs\Timestamp.xml

Filesize
42B

MD5
f3f892f4efacf444d4da210d9032db67

SHA1
753da8c095e1e4af8ff77cce88d96d45317c5014

SHA256
3814e06cbdfb1de21a075506fd6cb47adcf604407a22e73351c48cca4a343ecc

SHA512
0c79ee4dc1a9f02d6209ea36dcff4c9727d3a832b26d7f2afbf8ee5c4fa4ed2d3597eb01505623542a756eb7d745911826e64dc0395cfca479b5a77b5feb6cb8

Download Submit
C:\$SysReset\Logs\setupact.log

Filesize
116KB

MD5
48ea729b0ae6ba5935567afd5fcddf5f

SHA1
c24cc5ce557099726e48a4e859ea1b6be02f763b

SHA256
bbe243e064d71ff9ffdedb77c9d2011b0a477d3c56167e3d7efcd3acc2c62e8d

SHA512
12d270fec15a1e1b14f278dc9b52d3e98524d395c25e7a564108fb986a5d80c2f51e4d1bad2888ded241347423b536b89cbd796600fb3d4a758300424fc8e51e

Download Submit
C:\$SysReset\Logs\setuperr.log

Filesize
974B

MD5
b5dcbb29cf7380df2ad1d3c2d55b6af9

SHA1
431b86106b401df7274c91b715ae24e9721eab97

SHA256
838db2c181823643ff77eb394ef996ff264e84a4b18f611fc2d622a3a8582f55

SHA512
5ce2ef6ad4353f78faed49eb1117502209341f4e198f0262869b959bfdc00c253de7382767822e60b9a21f058c2e60f0a30c8cbfd1fa90cde9d981ea015571bb

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Installer\setup.exe

Filesize
6.6MB

MD5
8ae106f9f32723071b7d89c0dd260569

SHA1
c66b0f1b5f01b0a6a8eb0dc32842983f05c992c3

SHA256
c4b55f6e4150ef16f731a7b10012eecb83b5557ae45ac2b3d37b7865d69d1b26

SHA512
e96e3f14239b4fd1c2e6defa65e1eb9920efcf870ad98bee872b6248ab13032976d0340f99b490d6b7034f2ac099ff4d5e613d8f46a812483b1996569bc31dd1

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.195.39\MicrosoftEdgeUpdateSetup_X86_1.3.195.39.exe

Filesize
1.6MB

MD5
2516fc0d4a197f047e76f210da921f98

SHA1
2a929920af93024e8541e9f345d623373618b249

SHA256
fd424062ff3983d0edd6c47ab87343a15e52902533e3d5f33f1b0222f940721c

SHA512
1606c82f41ca6cbb58e522e03a917ff252715c3c370756977a9abd713aa12e37167a30f6f5de252d431af7e4809ae1e1850c0f33d4e8fc11bab42b224598edc8

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
6.8MB

MD5
ee40308e2ffbc9001db2324ff6420492

SHA1
47cabfe872311f65534cbd4b87d707ccdef559d1

SHA256
38cd32dedb5c8c2af8ecd56827af5b4477a4b9ca3e518199d389a261baa999a5

SHA512
5f5fd0db005d49d63eaa81b288d2d6d40ce9c84cafd1c75d33723e47f23341d5ff254c2ed6274790242ad53f5360467d121cf1196ec7a073d4506166248041c3

Download Submit
C:\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
d346530e648e15887ae88ea34c82efc9

SHA1
5644d95910852e50a4b42375bddfef05f6b3490f

SHA256
f972b164d9a90821be0ea2f46da84dd65f85cd0f29cd1abba0c8e9a7d0140902

SHA512
62db21717f79702cbdd805109f30f51a7f7ff5f751dc115f4c95d052c5405eb34d5e8c5a83f426d73875591b7d463f00f686c182ef3850db2e25989ae2d83673

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
1143c4905bba16d8cc02c6ba8f37f365

SHA1
db38ac221275acd087cf87ebad393ef7f6e04656

SHA256
e79ddfb6319dbf9bac6382035d23597dad979db5e71a605d81a61ee817c1e812

SHA512
b918ae107c179d0b96c8fb14c2d5f019cad381ba4dcdc760c918dfcd5429d1c9fb6ce23f4648823a0449cb8a842af47f25ede425a4e37a7b67eb291ce8cce894

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
692KB

MD5
4159ff3f09b72e504e25a5f3c7ed3a5b

SHA1
b79ab2c83803e1d6da1dcd902f41e45d6cd26346

SHA256
0163ec83208b4902a2846de998a915de1b9e72aba33d98d5c8a14a8fbf0f6101

SHA512
48f54f0ab96be620db392b4c459a49a0fa8fbe95b1c1b7df932de565cf5f77adfaae98ef1e5998f326172b5ae4ffa9896aeac0f7b98568fcde6f7b1480df4e2d

Download Submit
C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe

Filesize
389KB

MD5
f921416197c2ae407d53ba5712c3930a

SHA1
6a7daa7372e93c48758b9752c8a5a673b525632b

SHA256
e31b233ddf070798cc0381cc6285f6f79ea0c17b99737f7547618dcfd36cdc0e

SHA512
0139efb76c2107d0497be9910836d7c19329e4399aa8d46bbe17ae63d56ab73004c51b650ce38d79681c22c2d1b77078a7d7185431882baf3e7bef473ac95dce

Download Submit
C:\Program Files\Cheat Engine 7.5\badassets\scoreboard.png

Filesize
5KB

MD5
5cff22e5655d267b559261c37a423871

SHA1
b60ae22dfd7843dd1522663a3f46b3e505744b0f

SHA256
a8d8227b8e97a713e0f1f5db5286b3db786b7148c1c8eb3d4bbfe683dc940db9

SHA512
e00f5b4a7fa1989382df800d168871530917fcd99efcfe4418ef1b7e8473caea015f0b252cac6a982be93b5d873f4e9acdb460c8e03ae1c6eea9c37f84105e50

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
14KB

MD5
e679b90e8434603dd3bddcca12ecd409

SHA1
660fbcf944b9195ab1578cea432ebfb02dffbc82

SHA256
6f5faa609cef715a7ef113e4bc14b3d4839672f7bb948a59f559a2674d4609ac

SHA512
c4cd727141208b4e670d072073051ab1dafb690c37b8a4933f41f149311c136cc07507521dd201c890b0ace8420943cf44a0a2cc95317dda7e2f9aca52e7b2c3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\activity-stream.discovery_stream.json

Filesize
22KB

MD5
6f2da89b696d1b8d34bb96ce51c59805

SHA1
bcaf5a59ada04469ccd8cf5eb47665c859fc251e

SHA256
5be71e81d9106fc833dc3e8ef128d43a6bd0a59e179cce7028b8509b3c03e493

SHA512
3b28699384054f864ceadda718e9f6916326efc0ed4f7b1964024c8a8ed0bd4f0c2eba5994c3b45b2eab25273121e40cb1da5a2655748f56330a01cd31608f46

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\cache2\entries\05DEF887C9B1DE00A58355F745A5AA083C94E9BE

Filesize
108KB

MD5
007db68c3c04ff64a5a7d30bb7db0f32

SHA1
59cb05305c650c3011a296bb6a229419231485b5

SHA256
4372fe5e6aebafe1fd40c6b313996d99a02173dccc285a892c028ef09f0d2a32

SHA512
24de4f9006a0aad9dae11ffc94fd05b7a9b1b2ccf06d41626e14844df889fb9fb2637c109ca63ddacd63d5ded7e6f11d3d2196de5ef1d6129d7a0d4cff1a03f9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\cache2\entries\19F6EB35B23167098D7A200F623F38B30420B75F

Filesize
208KB

MD5
500a6ade9162446ea74169e8ae7b7690

SHA1
ebeb0657e4fa9fdc222ce5cab4114240f69103bb

SHA256
20590df8b40b9aafd7c68286de1334a3ce216d330a4d32c0df6e97dbaedf6c65

SHA512
c0e87f7ddc4f05d7a95b92d41574d705406cbc7d0d2da2ae387de4c1921872365fa73da2d88ba4512238c8eccb607bf701d60ccf54dd723de6e485b0942ddfca

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\cache2\entries\1D76C909465AEF372DDFBDAC0D1FA6601039B846

Filesize
3.9MB

MD5
f37dfacafd22aa1a253731a595f17698

SHA1
5dd19fe0567ca0557a3456de9448ff91fc390a49

SHA256
0c2f3914f2b651d74986a44689ffebe2d6da9f98dc7935f10714498ad23983b8

SHA512
a9a35de14bf05ea80a61afcbd41a747bf1ba24f0dcd142a80cfb6f5dfca5802da0ef27c329b8b110ab632fc99e5184e6329fad96e0f6db7db7178ced95ee4419

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\cache2\entries\2DAFED1FFA4D7E6A0CA81A21A9783F5E75F52F0A

Filesize
61KB

MD5
cf7d2047c197959b2698ed2ab57a2bf4

SHA1
63dd43d69c21e75eaaa170e3b5e5fce4085ebde6

SHA256
da6dfac9934491efb060690805884b913caa3d2eb447ef74b3e907171bb879a4

SHA512
530c73f261ebde1db128f3036d8cfc0c6074824b13208ba867fc1733e48eed5f5f9784c20660135c8681540fc4a5d6c7ca9e111a96549837d9194fef49099339

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\cache2\entries\33CD52D8CD4D32F7E99F3103BE76D6792272C7EA

Filesize
1.5MB

MD5
5ad3b6a5ed6d10de35aa49c9eab48c5b

SHA1
8cb4bf0d4a0611624f8dcbe9e9b473d8e41565bc

SHA256
b8406ba7d41ab063ce82a7b7f4137781cabd145281460f1f2a3f8a8cccfad3fe

SHA512
467fed1af1b2e7038d1ee2e7e3dabae221406425d0eaf28294fbc5c082a53d5ac81186a5824cce7f07606d92bf35cdadb824eee300e9eb9c029f6ba5100e7b8f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\cache2\entries\3A14717921B242DA10262520292327972D479652

Filesize
140KB

MD5
41aa071c9bb1cb3e933a430f5abb1b77

SHA1
d7a2a2d617467b1017f04b0bdd478adcba89292f

SHA256
41e396f620966ca8f5093d24a7180ea62e73b39052493a61673e2af02a5c15b0

SHA512
df13ee12bd7b52876a35566c53f2efd66f051eee78b098a836134f70f2fb5102cf0c34f5a72fed1bcfc686f278e6153e731e2793068162184913daed16b16a95

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\cache2\entries\4EF464361884FF27DA877BFB59D10EA2A4BEB579

Filesize
132KB

MD5
7326dfc29ae5f42b64a2bcea3921feca

SHA1
353fefe49f03442da363d8cd6675614baf0a718c

SHA256
c314c2336e77a6f78d64f4760edb3ef3cab59df7bb0999c773b1a45d9d4c24fe

SHA512
68ed15efed83853dcde416f0928cd062f6a1ab74dec9cb54b12458d8f184c566affc806f9d5f84a1e91dc085fecdb8d26143b638ee4858ba67ca66b422a94f3f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\cache2\entries\651B52AECE1B7E52BA3588014ABD47165217B920

Filesize
33KB

MD5
f870fa6a7899dd3f2abe75c85e4c447c

SHA1
a1c9f2762c4d2f7d184179f46ca58812901c2c0d

SHA256
0f5b985ddc13ab0fb852e306046d9c0506f59d133a79c87e48a040abcd1830e1

SHA512
418b7b5f12c1c224c118ba1ceec2ac12b40673d536f19964189d2572130af89130be195a8a52bd074296b0a7df644fd7012d35d1c15efb64350b04535e7c33d8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\cache2\entries\73EAA0767ECF1BFF6C0396D2598362046273B2CE

Filesize
30KB

MD5
56fe1f741096440f47ffa521f56064fe

SHA1
99730a4dda1ffdc00293408fd8d6daf70ae0f342

SHA256
533f73d2d2e50d03f04034a61ae3d01f2baa44001bbf6c0bd4c1448a96f40a14

SHA512
ec77e05fc61f871ef8b75db997b25c9f3af76a08d650b4e26bc420cf40ff6bbb74a126b533a40f441f2a23a70e0f9d85a2dd04ff0d41b46a4b4ed381756300a6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\cache2\entries\76DE47577ED9F4DE5C60DE157E810B8DAE0CC1C7

Filesize
363KB

MD5
70304ad585622cfd02a977c829127b2e

SHA1
86096abc3581e3b1e86fd1c86c3fd8749102a92f

SHA256
e8c6be94afb4b1f70bac71b19bbf195d3a8eab4ec4bb5f2b8a64712f059234b5

SHA512
0f61747615b51baf3e84df9a5caa7754ff61a14b565d775f60f1ceae07d0a7d4483c1a597ead1a84667dc8f6771472b4c1640b940e25374b23b9e390af7f54c0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\cache2\entries\772AB286DE51CA173AEEFCD5E93F6DCF9ED04CBA

Filesize
2.5MB

MD5
9bc950bb6ea7637ce6630fa0522b6976

SHA1
a75d9967eb04c23487dc6728151e6fb81db0bfe1

SHA256
b2b812c9d5ab920d4baef8e5cd13fd60992f9b0d6f609c2e49ff96c6aa4a06a5

SHA512
2a7884ab1cbd655b5fe57388df1b13d9801bd5d1aa32a3cd9fe636e1c93eafe060edf60f4621f8cb2d325b0e3677f2f1fa097782720402dff1b0ac24845627b0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\cache2\entries\802A9B95DED4B8648553F34BE922A958B5CF005D

Filesize
65KB

MD5
dafd828de0f3320fc41cb0b26afe52db

SHA1
95c19cc6e1e6ed95430a3b27cb798beb44f06413

SHA256
afa7ade4a7d5c41773f1ae099237a3ae430a3756bc891842bba4bb329ec3d8b8

SHA512
55637a9c296119719b3868da3e76e20f7560dd2c1d93a6352986be4514e84539760789aad180074e652108b5814604b054d7433075155cd60181ec048b9f19bd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\cache2\entries\914360ACE439BCBCA56A0AAA092B931C9938E053

Filesize
122KB

MD5
885064c23b7b2522887eb9ba1c6129ee

SHA1
f717486b33f0b2e429837a35eaf5227b9174a854

SHA256
2493529916bdb9c0d029e52943b8af33e385210064032eb7bffe03a9bd1104f8

SHA512
b890e26e2d6794c95dab374724c558114ac21d3dc5b78239ba5352a667cd16a5b72f129a4711a272fb4b4139790dbf0a1f7ac1a9400d57b71a044b4f7a6d4678

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\cache2\entries\A445252C9B921E2B7EA06166663C3E214C1A6851

Filesize
152KB

MD5
fd9ef9594dc0aea3484096ba8ba4663f

SHA1
f25e15ab1225bc514c67dad14af5384f4aa396f4

SHA256
0e2ac36043973f86f6bda3e869fe1fa84d4a7ea466670e197f7b6d1985568894

SHA512
1d5a2fcbe62dca70fca6eaff87c6d02474c8fe147b330eefee749ede482c0b71543d95dd5ca47767f51ad229b10ca2a0e212026126b4c6d509f73629f6e2b448

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\cache2\entries\A9579596936FE38BC2C60FA84FC809EBEC1ADA1D

Filesize
382KB

MD5
a1c996dc16d0e4aea1b7c59000fa10b9

SHA1
777c41017cfa79b63e58b3dc2f3c4bc9285e7e1c

SHA256
0fb9e57fc914e826063944d078d87c735a1163beae4a8345c945c6089a587541

SHA512
8abe25ee51ca85f6edc935e098fc7c7e02d28c10070ba8e51460193a46c0bb1abbb5e745cf8c4de1ecf09da3e0f9b95a557403db9d4f749718e209cebee06f6b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\cache2\entries\BA30A8866A8313A16394DA2599448520494928BB

Filesize
30KB

MD5
9d225065c703a1578c8667e25c0b1701

SHA1
2b46284c533b5339c95707ee644346dc86521193

SHA256
67b14ff4452fde170960f7cc83677e0686125e0950b669b30d9853a2466da2bd

SHA512
15f0bee8eb4d5e6bef3be8da706ee012bb30dbd413f559f4354c90b0c475845a48280a8512a6761c44a7c86552ddd2a1a714e67d52df0957c88174e0637be706

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\cache2\entries\BB75FF2209E259CA2641FA48ED7700A32DE26C3F

Filesize
1.1MB

MD5
7284ce64ade283a73d6a9baca157cbf2

SHA1
f2d92173a5ca1bb4c589d8b182a752676b8cdc5d

SHA256
411be3cd84e5377e0f55b1e583b55742581a072df37cdff17e2eb6db860e3ad3

SHA512
d54a4e88273aa328174f7eaa14cd00e0121a1e5d0da46c9a712a614ecb5ca4e21b40b6a4ca64e86b070ad9638661f3af5f12e954d4f35622ff87d72f30cd3216

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\cache2\entries\C0F9DBE7A7D5CFFB39FB5990A4AAF3639DAF2E71

Filesize
170KB

MD5
9166d6b0c105bbddd9f6658d08f7adbf

SHA1
b095fdea09c924468103f0ebb0a415df78fbc299

SHA256
64cde37fc0b7705af2be5f091c2f18f7c774aa7a1ec190c8a41198bb051d41dd

SHA512
2d0dcce6b176310394de4852b0d7c0a0109e309f2abdb6909ea10944bbd0ffe61fc321a3393114ce9fd9515e0b99420d41bbccfc4e099a03a4ef27ef4069e6cc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\cache2\entries\C7F27F1B728D8DB7CFCCA0B5822E7997A8F337CE

Filesize
617KB

MD5
d67dd98dcd9455150868967b3517f0f4

SHA1
ed3a5513475dad962977db873e5021b2956ca6b2

SHA256
d1960ebf14e609c9b81d924e3b28d0289322d602068506a7d367c3c0c02eda1c

SHA512
a4c37ec628ea20d0bce19bef51f2d4f061ee1a42afcc1c4ba668c7f8db68163ada51c3b05a74503516c647f3b20b5c7a65545b23adb0d97479df475799e727e5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\cache2\entries\D01C65D4A9E589901526DC7A0BE1AEF468C005F9

Filesize
488KB

MD5
68eb0707a3615c207bf52ef46a989494

SHA1
91c25a5deeb63661a8ed6f5fccbf44fa2540c1c8

SHA256
f884f1721cc2074d981ec6420b7f4df264c374142ef22f8713699b8597bf4310

SHA512
aef0dfdff4a04dc101b945ac1093dfc533e852753e7bbb2696f517f2f88af5f6f7d91539329c07d261f56511e429bf3bdd2078045f7520e7c596722a2ea2d1a7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\cache2\entries\D29FF5D11BE74C11C790BEF9E38B7736A67FD8F0

Filesize
519KB

MD5
9594e463cab8350c882fd9b6913c2259

SHA1
0fb0e6a77e9d646a498eb75bd0a09623bde58172

SHA256
9c03217fb1c4af7357ed443803a801ba483dd085bd6b4921bbf385c55f890510

SHA512
3a77b90e9d77ebf9619d1e1a3c3abc6e71ff6488a1c917ce425ae8139c9ca34a94f97940eab576da719f3d6c227515486e8822c2ef11b85e8438b1e45eb16d21

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\cache2\entries\DC904F6FE13AF2FDD1A89E5DC2045B0E5EE12A27

Filesize
224KB

MD5
6ad0e0068ef7ef01fca7a9a3bfa1d18f

SHA1
c451df7bcfcb12a8ee5333d27244ff42f42d73ab

SHA256
710fc3f4f675a1b3a83d53bde79bcad4ff9a412025ad9b1b0d06c804ce999193

SHA512
34fd92b3405c30ff160dd4355354e6741242a235a38b8bb3718bd5b23ca3cd29848831c29b946b676414231db5be01a0601de9149f689ce082b67a86dc065d36

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\cache2\entries\DF88F41E5DAC45B039B785901EE8352DCC6CDA96

Filesize
49KB

MD5
301542330da7e1d96c6f28b609bf7eae

SHA1
b9069c6af4fa6c1cd2a5ded33fa53caaa2b2eb45

SHA256
c159c6de84509dbd7d94dfe7dc5cbbe7de0af21bb380455c09db97c920d3b55c

SHA512
d409c051c435c42a988f27b8cca29423235f4f72e685e05ed48b55e3a1f54ad557e70b3e52ef6439ccff1813eaa203f2a142a2baf47a0687c90aa0f8afc8f106

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\cache2\entries\E0B2EF9682D05F56F9051D28F2C4B6AF7C878A89

Filesize
76KB

MD5
cb9720537ea403d296adaa129f930d1e

SHA1
013b4150e3b078ebc89d4be84c167fc238dde547

SHA256
b1a1bfb64944280ff5ebdb28cb60bb52a2678cea31deee60dc53579c4de7ca72

SHA512
3c0bc7c02e06e6b1dd9028a626c213a9e11ed53a62dddba2815c7f14e0386e00cfcae8503648378f26e315ccdc8d879f5ba2bfff8f4c398c19c3e65898266d87

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\cache2\entries\E25BAB6C6B0C9743BE143B75AC25EF6F27CBC000

Filesize
21KB

MD5
8dbafb1c0450b2f45bd9188c709bf80d

SHA1
7af4ea79b908b3c3eca2be165472f0525c429ae7

SHA256
fdb3fb285c0a051e85c334f3a1fe0ccf2cc2d93075e4bdb8ca66305bde0b904a

SHA512
2ef4525d3a9476b384ac05935f48f4c19e9950f985b8161095fb5332762b9ffe3c52f657a309c931477c24dd9f78ba678855f6702d738aae98f727535f0ebf83

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\odgo8eah.default-release\jumpListCache\TLNMYNb0EGp7OFeeZ9w4txNIEpq1Sm8Q54bv90uOMdg=.ico

Filesize
965B

MD5
c9da4495de6ef7289e392f902404b4c8

SHA1
aa002e5d746c3ba0366cd90337a038fc01c987c9

SHA256
13ec8c9e113de6737a59d45ea5a99f345d6cba07f9a820bb2297121b8094790f

SHA512
bb72f0cc815e7b4c44959808b153aad28dbced8d97e50f83ef90229d19ea1c4b3fffff650bf49efe562451fcae0325cdbdffc1a5c4ec5d2c7c70ae9d1a0d8a16

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\c7f59c28-3425-4ea0-8c09-3a19fdb58ccf.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
11KB

MD5
9edf4df62769ef5a8375dcfcba4ba702

SHA1
e2a1d8e812bcf13ce0af48acf630588a7811801c

SHA256
b94b16210d69a92e632cd37ee01aa4b20ab3f6c2dfdc64ad8100bd9c944e3400

SHA512
4a59db0a3517a81cf5a5f6b4e27172c00793aa42784cd897a949cc51885b45b01c813eea0a43367e7f9d6a540843aae6d07cfea66ecb1256eddb4f3797205364

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
11KB

MD5
5dad8d306da53e1818a094d8a1856336

SHA1
253afe80fc15846ce82a7d1a9cc5ca7442bf18bf

SHA256
6f1b546a968f59fc42f42e0bc3a63171d37bb1edc47f00ed283907b57af82ef9

SHA512
355073fa31c6de15e6c5403019b6a6ab7dee9da1acc5e4404c4113b013b4340efd4772383852b4f7063a47b936be4db31d8949c6040cad8f1c3714ad55377d8b

Download Submit
C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\0e4df74cce0423376e6a782e4b3deb64

Filesize
7.0MB

MD5
0e4df74cce0423376e6a782e4b3deb64

SHA1
8db193e73416f1da44ad98f344d3ff207ace44ac

SHA256
8b9263763da2c73054426eb6a8de5c4e7f42ecd11e9c95a426b0c66aedd727ab

SHA512
ca3136acde16e33c80a0f50c5f73a2eda795ebf9a90f7bcd4803b5cf2c51135b2ec2ae40d06015ab6fe4b2b18bfc0a95712bc98dcf5f2cc85192bb715a021642

Download Submit
C:\Users\Admin\AppData\Local\Temp\96ba7c46

Filesize
1023KB

MD5
04d0149764d1421461f412fce86db22e

SHA1
32c93f36080a316c74b41fed5a1f84f315de1a60

SHA256
24377a23cc313a941d4238cab09c2dfd34509b9e1d49ea68d121c342c3aebd76

SHA512
57c9514650e36d465bcc1b8f6d0a30037ecd903cce888627003d6cb95b32d9c2dfde33d75b6fff3c2bd92407f54467a14e7161bb52d056e1fb163a38f39e7e74

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cheat Engine\{7561B402-607F-44C5-B973-166A0E5698A9}\ADDRESSES.TMP.FILETEST

Filesize
28B

MD5
b6d520474c5e852738d57bd6249b22b6

SHA1
c0511c70f85357ae6011b46a55ab51d15d114502

SHA256
029e56ad5c2da0b8f305c3c2ad73204822e5f64e1aaea803bfd3fbc57bd47e91

SHA512
b2807d55711acf86adc2b347f5edca567e84c9be2c2da48d68788b8cb30a991584d9a626b2af40a72c632625b05c62a8647e0edc119717b85b63d2224f5e41da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cheat Engine\{B3CB1EB8-7EE6-4D5C-867A-6A93B47FAE52}\ADDRESSES.TMP.FILETEST

Filesize
30B

MD5
826273a91309b13197041791ba18034c

SHA1
c1d7c61766e2cc7c8f4fc156c0f002017eb73721

SHA256
4876aaf849bbfbe676c85e6f9a2d842c5ec7d2bc6078302956101030f155a7ee

SHA512
835a3f71d485e690a13945f3d5eb71fb507b07eb18e0288548569c953ab2eb59211696ffa87ce8a7481df929b3277dea1fbd0495fe771994b1d2f3e4869fb9dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9VMT4.tmp\WebAdvisor.png

Filesize
47KB

MD5
4cfff8dc30d353cd3d215fd3a5dbac24

SHA1
0f4f73f0dddc75f3506e026ef53c45c6fafbc87e

SHA256
0c430e56d69435d8ab31cbb5916a73a47d11ef65b37d289ee7d11130adf25856

SHA512
9d616f19c2496be6e89b855c41befc0235e3ce949d2b2ae7719c823f10be7fe0809bddfd93e28735b36271083dd802ae349b3ab7b60179b269d4a18c6cef4139

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9VMT4.tmp\finish.png

Filesize
248KB

MD5
b24e872bd8f92295273197602aac8352

SHA1
2a9b0ebe62e21e9993aa5bfaaade14d2dda3b291

SHA256
41031efc4f7e322dc5ffacc94b9296fb28b9b922b1ce3b3da13bf659a5fd2985

SHA512
f08ac681abc4e0f6d7a1d1f2303169004e67c880f9353c0ed11dfab3eb511ddf841fa056f4090da8201c822c66ae55419c48cd87f11b9866feb46a3fe2c2af99

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9VMT4.tmp\logo.png

Filesize
248KB

MD5
9cc8a637a7de5c9c101a3047c7fbbb33

SHA1
5e7b92e7ed3ca15d31a48ebe0297539368fff15c

SHA256
8c5c80bbc6b0fdb367eab1253517d8b156c85545a2d37d1ee4b78f3041d9b5db

SHA512
cf60556817dba2d7a39b72018f619b0dbea36fb227526943046b67d1ae501a96c838d6d5e3da64618592ac1e2fa14d4440baa91618aa66256f99ea2100a427b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9VMT4.tmp\zbShieldUtils.dll

Filesize
2.0MB

MD5
3037e3d5409fb6a697f12addb01ba99b

SHA1
5d80d1c9811bdf8a6ce8751061e21f4af532f036

SHA256
a860bd74595430802f4e2e7ad8fd1d31d3da3b0c9faf17ad4641035181a5ce9e

SHA512
80a78a5d18afc83ba96264638820d9eed3dae9c7fc596312ac56f7e0ba97976647f27bd86ea586524b16176280bd26daed64a3d126c3454a191b0adc2bc4e35d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
18KB

MD5
af4acc757c634ff0c15147128d852971

SHA1
49cd4f7d7beb61864a5a3311044c9143ebf95d02

SHA256
9ee030516f0f4ef8bbbc3b35f95a1cbaf51a0de6c8a7fb7a080adf85c4ae387a

SHA512
5c081b208f871e92fd3d9a14bd4d83b58247232b6806e947e07dd8fadc23a6bfb9164c918383c9e1ac0fc279b7419f8864c60d228daeb3b8ced98d295f5df766

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
20KB

MD5
7d94b3dfedb7966070f2b6a67c67c459

SHA1
5f78893cacaf3452a07e61348ba27e7ba5b3a81e

SHA256
d6ce48739ab0d8e19c9fbee3b28b0cdb1b5a456f05df9d2ab1d1b9bab5dc242e

SHA512
4a2c7d88f037075057d55602de6fefe00a052388044e11047fa82e85c17c9baca85fa5200d8a9e3e1a645e85f09b0815fc19b6c258b2fb320d89ec63106e028b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
892fa7d32cde7c282886cd52b0fece62

SHA1
b00bbc4dd93e85005093e257453c7ffed07578f7

SHA256
ac095cad9518418db5e3eddcf166fab9bdb94530c8943e81d6f95e1a6db90271

SHA512
fba5efc71e8f465b38e14b50e5f67d86db7375fec4de74a65f124c7837265eb6f13e0f760e40521b5f29f2fe8b2fc2b638dc21535fe9b3b59023be2d5e17aa9b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
112827d2e676e1770457fcf1d44d31f6

SHA1
3eb4cf3b38bdef7066446bb801e98b38ddeb5870

SHA256
d37146e7bfc8f463d646766b228509a52666a377105bc42e145d617b454b725b

SHA512
9786f7ff6e5e624a26b4dc899eff1c96500adec07905a7422579723c302915245cd88e4d416faa4e82ee1ca847984937dab7d960b9cb3d7e9dc270a38064682c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
18KB

MD5
bdd06be475a23d7ad9a88c5f1c97a459

SHA1
014d6103b8ff38a4a37fad9b5d4d7e40e819d0f7

SHA256
8a9e8ecdabe03401b4598c108502b8ccadd7b7f60a918311610bbf3f75d7a405

SHA512
76452a605834f937a2858a8bb1cda941a25477d4814181f7136a9717091967f18b1f637d4f5e57aabbd69082a19dbf1c7e1a7844f5cb38c047ffc463a4ce5e7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
18KB

MD5
d552d94c1154a3cac4f6c2cf3cc6de46

SHA1
966eae54208895a4212a121bde6442d370a427f8

SHA256
ee93a8773313c3c81cc3e5981213ac4e239897937b343267734fc38ebd8b2afb

SHA512
b79ad0bee72206fbcf1e1e9c646379f5c5e3ac662c641e52fce2006dc468bfb9cbb8e088ac47585bc9f047e86ba9db0efa42c1d1aa48ba7888a72382c6c9cdcf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
2d82d44f1072b0f546059f68e607a154

SHA1
b9932e50d4b96e24cb4e283d9dfc48c62e3fa9c0

SHA256
fa782efa3cefe3feb11a20661c97a3d54ef9ad9d94b34958c3eb4bf09a98e69a

SHA512
fb6230c136126cdb5027b84b88cc6be4bed1d4abb704d454014fb6c322fc1f679c5b8e9bd6dc3901dc285a3c7e9597e2b7bb86436a661ee434a73a64f60f24da

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\AlternateServices.bin

Filesize
8KB

MD5
cd8c781c3c8afe23125e663afce58c81

SHA1
f3cc9bdb219744eab538a1d4b3bafcd5f047dd49

SHA256
13931f27e4c903fd58ee2d3ddeafe7c507d92400f8624be0cf9750626ccb65a4

SHA512
9f070fec8320231a963c2de0501d5d4449ef762e6a33d4b7d62aea22129c49ee1317788adca614c99f9631060c794e91b120e44b15f257ebbffa702a83eb2b75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\AlternateServices.bin

Filesize
11KB

MD5
d12a7e2868d08d6e50c87b05aaddc96c

SHA1
06d03c7b0d0ded22c2dc44846ae8cbc2ded36627

SHA256
c3b344e36443c87c3589c2ed0e032b51df733aaaad9ad630cd7dacdb4eb5f40b

SHA512
85152ee6c010d13b9b5684ec2c72cc78b5be25912d4c4c60052a5700ed2a6901201b646885caa9367ea37a4791a09045d37dd76bb6d4d1987a5306ba465f1c0c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\AlternateServices.bin

Filesize
35KB

MD5
67bf732cabea7495575ed168e40049fd

SHA1
3fc3e2e29503c46fb455e31b43460099c1cce331

SHA256
8a050d965cd25fb7f8d05784f5396f8bd8b8a1c4b8e66f948c7e3d63a8645711

SHA512
b4002b3c87196ecce889c9d15bd55f17ba4382925b124065f95b70552f04c9d0049b159143c838768302e4fdda6de0ed86d37bd230d184bc5e09733ffd7ea7d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\SiteSecurityServiceState.bin

Filesize
5KB

MD5
aad8e2afbde88b45d074a9458d0e9ff0

SHA1
355b065ee4ed02978b602a7703030e4f6a91dfe3

SHA256
fbbe0141a921dd227b7c29d7a20658c98ae06a9cadefb862323cbeb07b2247cd

SHA512
b5cee74ff2095b138204785c0b4ffd8cde0472d3da6f0315d38e5303931b124c85d327d95f15359f1f4cbae84686e9a41c4865f08d8252ee139670a9e6bdf3b5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\datareporting\glean\db\data.safe.tmp

Filesize
93KB

MD5
c216e283893380d00c45b4342c89d964

SHA1
4c31a95548a27b4dacb2ca8789d066d272ca20c4

SHA256
926c9f8430a23df05f643dc48579cedd7c937dd2a45e45c5533de1dffb06ebec

SHA512
d4852a585a3b6c637e36071b3656747d775919959f71c33fbccb74bfc187326c69fb0b5a1847ebd62e4c9925446c9d01b8130a367ab9a8507f7d3a554345b48b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\datareporting\glean\db\data.safe.tmp

Filesize
93KB

MD5
99ffdcee56720ef28d70f40a3343a243

SHA1
916b382beb62ee468f472bd290c5233b75a49992

SHA256
40012631ba40b4202c8cde1764b83502811deb6a4b03b78362337c7d98c10d06

SHA512
9da354f051f6d09d97532afa57e22eaa2e755ba74c5dc08e4049839e45d546dc11f0fc9a0873b02d936773093772e8f9706a53286345ebb1ce3df722d17a74d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
56f125e1379bdd7c9177511f2dd69363

SHA1
8d9c0f0a82a118a8109d9784b1abc1617fb58cc8

SHA256
ade95bb2a0733bc632689bc4e0716a253e7d45361089c7860a37d4791ec15065

SHA512
adb33b4fa273e63c8ff9c67151af4c6b51562878857ebf86a4e59d8eeae32dcecf6f703b81eedc195c9fbba338e051885a1a60b6fb34145a58916eec6d3a318f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
1c98e2da1bf8605d745245fe47811044

SHA1
989418959d7cbdcd9a16b8f1a070c96ae9088efe

SHA256
3f71f396a8ee570cb7c3ee4093fd8b5ba0bdc8c458578a0127bedf0f3d1b6680

SHA512
79fd93bc25f4ef909cab3c63d8462860a138160ffcadbf1f06eb948db611cee2252515ed7a8df76e9655720272fd9667b24be9f2bd1a46170a1b4dd2ade027dd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
a85ba90ca69d4352a4ef736498e6b06c

SHA1
c3bd95b082b28e3bd3afd292258c2ade4135b1c7

SHA256
dcd3be9b015d1c00d756e0c0f33b1be888162dd1eec42ac9d3cc11cae3efb1ca

SHA512
39cbceba5f4bea4d61ec73009c611a1170212887113d3b2e10a238e49262f234976ed753e2b439d8470693c9c2ed658f31bbe4f22e67d2ffed64a143cd478ef2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
831dca9aa9860d1ef739bb638a8622b8

SHA1
f66ae02141194fb16e689d289908d050d011678f

SHA256
43911534965ecc25c99dd69a79b610d33c5aeabd249df378157241f7a908110f

SHA512
38b4e9103d26708048b8f944d04561b33f6aa33d53e778dd1330ef624cc483a044fa956f6f3adec994243c46a73b4abcf77d25d93648076387f76cbc2a5dcdcc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\datareporting\glean\events\events

Filesize
4KB

MD5
fa09efbaca5bfad2c13426fc38f2ac5a

SHA1
971c1f3de2c31bb22c21e7e861c19a84777ff0a7

SHA256
fa545823c61532fd7accdf24c8ad986487d0d142c1910ae82419ef85937b2e15

SHA512
2003f0b20158c926c16d69a020f577cb70fb255218654af0e19657069b8881254f5e140018bc9a716c71358315ecdc0776d3d050da870b8785f3ed16b32c3b29

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\datareporting\glean\events\events

Filesize
5KB

MD5
bac2f9f340a57072f3072636520b8484

SHA1
333b727adce87ed580b82ef60b322d155f700a71

SHA256
d04b69ae7a78524d09369458fa1f896ecddf989d931b8bbe591161d6da23da22

SHA512
abfd115dda84fc9dd114b4d6357a5726256957f80f1f01f94a1fbccebb8f0b4016717ca0366b58b66f8d778e8b07ce1c4a2c238d0ef580b8c28a23222319821c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\datareporting\glean\events\pageload

Filesize
4KB

MD5
885145fa747c8a419dcd68e45dbb7fc6

SHA1
80147d115100cbc2c837a708c3ab8f6b42e9b1e5

SHA256
a6e097c239880b827c5f4d863e4750bb74ca88adbef2a2c8ba68c3b9ccf5b74f

SHA512
5aafc3b976acc0103147a27bcd5904d53160ffa1f3cf1d6a0578aefb6f7a19136f8b216d8e7f0d165b76b6705557345ed9c9dc2ef22c9c9150885cbc267fc9ea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\datareporting\glean\pending_pings\34f057e6-3449-4a81-871a-a247c0fd592e

Filesize
25KB

MD5
eae8346be6b79d80cfd86c9c20ded128

SHA1
37711b7bcd81b6c07d877b79db46206f9b78caf0

SHA256
f7fcf294b64b004b5ed4af5094a0ce0e125befc2bfb6fec0a3af509b707f72fa

SHA512
a81c0bf598291cd6266ced3a08367b12522524182d73dc1556b020a98ca09df0256f5288e32c330fefed80149a8b3b0833bdca471b79c32594f9982fb4034ada

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\datareporting\glean\pending_pings\822e38ef-c931-48b9-8402-923091b53c7a

Filesize
12KB

MD5
db07391fa746e70a71a81cc900c269bc

SHA1
dc51abf46cec5a4026c9676573cebaa0a9a50eda

SHA256
6b8db02d4bf9d9965773e950f6a6b865cb8a2a883a9547b3cbd73d1e188a7824

SHA512
6a0524e36a541a658c84242bec8958fcb7e94c059c7db444d01e002473efdd2a07a8d276d28b22ff5aa751a6888bfb943768be08b3863c673cd3bc875a28272f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\datareporting\glean\pending_pings\9c8d73b2-8e7d-4532-ade4-c11ee922b1a3

Filesize
982B

MD5
966532220a34c651b0ad3afdce86cdca

SHA1
fff146afd0be1132c391d7a05aa1dcda183fe928

SHA256
ba6ff9351706e9883e49ce44cb1b94e008a3f1e6a0e85f81ac138414ce444edf

SHA512
3e396bb0e2ce0bf0cfc762c475b7ec48261bdec1b5e405f3cdd49a441649bdd25f41d6e16ff56b03e04e24604faa2bccf106c77634e86522b380c9913ef2be1c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\datareporting\glean\pending_pings\aeba549a-893b-45cd-b7fd-0e5398f58828

Filesize
671B

MD5
836e98608ee7ff6359ad0bf9b1f74382

SHA1
84b88b3850c9760d07e36f3710797a0e4b93eac5

SHA256
a4a8ef3f00f90e35c10e9464278233eefd8957aab065c6606696c4aa04ee734a

SHA512
8cd72cc95fbd1e97fe066e16bd8fcd00cd1bfcfac388cb5d58c284976249b8da1288e3dc2e0bf78b735e3bdd57837843965692a1a1121c5a523039f85d21ec53

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\datareporting\glean\pending_pings\c692b4cc-1d12-4961-ad58-38249d8960e9

Filesize
847B

MD5
a7f4c571b30f072d0bf0534511caf381

SHA1
bda69feae8da51e039e0e074f6bb7193af15b21c

SHA256
848c1b68ded2dc9e91938b0c61905203deb8d768895a86d32b265d58fda08d54

SHA512
e239867e0599dcbd9d9b3b2f291b85de635c8e62fff9414cba829db00dfeb058cec775ecf07602ebeaf38b541530b1c3ff72f0e2a21e8798e8369a9178b66e93

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\key4.db

Filesize
288KB

MD5
ec1df3335d262ab8f4b3e73f0f496b8d

SHA1
d6a0fff30edd0ded3ff92eb1f527308c7b0afe58

SHA256
25e3ee5f1598bcbcd094f9bcfc9b992bba4651290982fa2b3f2c850ab9730f5c

SHA512
a46151f6a63d0d64bd69e377016c93e28e03df41cd213776db82b520df3354589adb25a675583930eb12b48b17ea4455d49bf6e7bab02bfc87c7c873109b1fd1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\prefs-1.js

Filesize
12KB

MD5
47b4ac0dbe689c247f1046998778d5c0

SHA1
972232d2e885c28c8688e608b6cc135af8629bb0

SHA256
5918f9c2cffbc729a07db014fb7b6d497e5f8871fa83bba566624b1c81061d99

SHA512
7db771c2b176e3de30cc8aa085d22f4788a6e82c7cd2a87fadb0b122a37ce431ded3b9903b9d768b9496d0e77fa7ab842c46a6ee4f9e70275e7e5a50113f4686

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\prefs-1.js

Filesize
10KB

MD5
a6beaa4d1cd2be9dceee7397c59413c9

SHA1
7c11a6b7e132c8060b600b25988639cf0acc4622

SHA256
ba56cee3fbfdda45ca3a72a1fb2037dcc9b80e182daae83d1478fdfa5b6cbf46

SHA512
6bfbd5739acbe17c88bed96573ef7ae3bf9dceeea57dbda889292a50b3da4fbf822b9d780b76e94dc7f3728bad68e9a7435713745dbf3aa2a461f5511ce8a513

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\prefs.js

Filesize
10KB

MD5
2ac0ebfe15ec6612c2a5e6285b8c2009

SHA1
5b696f8329e8b357314d5bc2694ed5a9df68d9bc

SHA256
f7d3cfcfc851b44b8f5ae2c072dd9e6a5d19cb7516512796f13f436a3d17768f

SHA512
efc46ebdf816d5c25059f4e463027440a161322ccdf1e0003eeeefdaf222646c4764da6809859c0480bc62aaef97c37d6c29d4be86006c3f7ef2f967387ab262

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\prefs.js

Filesize
10KB

MD5
883d2010947ced0fdae1590c5b569bf8

SHA1
4af9e473324240c39d0d5f81bd66e12acb532492

SHA256
f5d8a0c273e5ce333e7d0cb9124003db61a1a3ea899a05cb359e47d96838560a

SHA512
04a2aa968a41b7e5f251de2c2b22c6595157eabaefdc8317fd568ee1c7e2866812b2c74519dfcd04cbdf5f488b5cc6fa535403481a6974d2a25dcd4593fd0f0c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\prefs.js

Filesize
11KB

MD5
24e2d5e248c1b3050e5a515a2277dfe8

SHA1
fb800ac6327dc0e7c6118bf47d40f3cdcdde0d0a

SHA256
5169d2eef0a944eee47b3223c566a13e61435d529b2cfba6c49a0b247c66c1b7

SHA512
7557fae3fc0d23c9f63b1c372a1e0397573531f43fed1b225049c3e52641300fc7ad8bd4d85ab2e430d29d447a52b2694149fbb505d7ab96829593f70c5115c9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
700fe59d2eb10b8cd28525fcc46bc0cc

SHA1
339badf0e1eba5332bff317d7cf8a41d5860390d

SHA256
4f5d849bdf4a5eeeb5da8836589e064e31c8e94129d4e55b1c69a6f98fb9f9ea

SHA512
3fa1b3fd4277d5900140e013b1035cb4c72065afcc6b6a8595b43101cfe7d09e75554a877e4a01bb80b0d7a58cdcfe553c4a9ef308c5695c5e77cb0ea99bada4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
5bb305e0d4e70e25af2af0f61986903d

SHA1
e1a153c744fe7003167be7f99887934121ecb651

SHA256
c3d2f2ab41d7ce2c606d54be26b09c98584bcbf80aa035bce3983a0ed8a329f8

SHA512
4a9fa9d22a1e5db53b062cc7ed39afed1c453d15028f0869fc46d6d30997b72c1635a236816aafea96aecd2dc6f774996b3a084fbfda7759e02ede83ff2ceddb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
49KB

MD5
33fe94431aab47a37e421ff024606c45

SHA1
f38c43e4e86fd14895f79bdfe7fd2c5dd7f30176

SHA256
3914266b6423eb299eda96d2c5dffb53713dfa5c59c00e39c4e0c45f7b071a21

SHA512
e0a0d97e3dc3d58284e96fec746f53190bd87ad1a8d4bd94c7400c333bd8826df6fb4c96abf6a7a953ed05927fa8eb06d48897b5116f6048f178c3aec5b882fd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
52KB

MD5
135bdcb1ba4f10c47322024cce3e59b3

SHA1
93a6922cbceb8f4839500a78385795780840a440

SHA256
28a8aeebab510863270f3c7aba76d3d56ed21a49ebe3bf87f7e8e0992d87e7bd

SHA512
38dfb9f86df4fac862cd634194f727a262f8de9c06b2d885a548a81f1517900aa61d53f878534eb76a94fa8e282e60c4e36e1855409d83b6ae44c8e89f37561a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
11KB

MD5
441fdc3537d2382e2b1bb7c8ead28507

SHA1
8225249cb70a388c4a05e465e35e5cdf2630d747

SHA256
1961332716a4584539fd0cbd4ecfe6ed331c10a3d08efed9e0a574bf3200f5d9

SHA512
b7068bee22276088497f12a2e1cdd082aaa18f23ebb23fdcc247320ea51275ace38ea762caedb28a026a29d43d23d5615dae860b5de269cbb3a63a24832652db

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
52KB

MD5
fcad4aef98c6ce086015aa5f094b7b34

SHA1
df58d79eccb8ef67c970d18896c673865facb6fe

SHA256
a05c21ea43d282c1d4378090a0d922fd4fb917899bde12a61207336204a23600

SHA512
ecdab1a6f894c6ef9942ed4e49bed6ac3707da8f7da0f62e75fc720abbebb0195c550b97deb6375e61862b551050459643345c44b21fe5d5a0d492d8881bd0ea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
53KB

MD5
1ea4c98998b1f1f9e304df0487e749fb

SHA1
121761e1dbc9f060581da2c215da38428608b871

SHA256
f25c8b63b87638d8f4e0805de4db59020bc0213f8ead8efd59171826a6d74cc7

SHA512
287d1eeb1d2d5ed08204a2dc43513dbbdf5add46446c7d11ea01927cb02c0171981bcfc871aa3f48b0a50ee3a2e1cd4be5b0c14b23a1964d4081aa1093bc867b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
11KB

MD5
dfe52922715c89ed835c811ea425f28a

SHA1
0e2c08131d01277fc17cfc6c5099d34b7fad39ff

SHA256
9fb1b41a9f3af98e3a135c0ad0829a9d63c4651daa75aef4e4e94783a1943649

SHA512
0dca16a1edcd60945a751c90c04b1bbac85ed4c3ef054ee3f02e55e96a8fc22925bd4bdb8d3b1bbb8c1a7987145d00bcae3bc22134a0cd8b86f2f15d90c97ff2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
54KB

MD5
5bd4267cd548f330bda010fe84ac1077

SHA1
84896eb6432e570f93bb3a3ace0fcb104656ddf3

SHA256
cf8711e1e085a1c862c3e6e5de94335f5348faf66d1e61a600baa9862a529a90

SHA512
99fc33bd1140dc4fc4f78fc3735c902ebe07e0e281b63978e738a36f5e7d45aa771108c5a1cae95076079d693c806e875af4ec3bd8d7ffc25323fa5da9bb72c9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
55KB

MD5
c3d32a340efdc152e1fe34aa0562777d

SHA1
142134ea65294fbae81280f07079049c951e69b6

SHA256
e7992db75220abdcda59189c630aed385bfe474ba637ea2398fb82d22bdbbdb5

SHA512
bd9b37293546b38000f6f5940da7396fd47ab3f27915e90d855e459ed5079c3203c8b4c1b22ab418ed115319b3c620b8933b5dac753dfc70719e0e69b1875f6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
11KB

MD5
269d4714bcce4d2f74192311a3796ff2

SHA1
7728cef1cfc79d425d9a1ae047e229b5d9a89bd4

SHA256
4a4f40c570c36c6b47de6109d85bfcf00021311bb1063b8a566176382b1e6566

SHA512
d8bd70f513e626a8a84e9c20a336e6b0f9fcaf937da287db33ce166812fb96fa5073f07290d29822085b7bf68a6717c383a9f38c3019f22044e3cab60e3058c3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
65KB

MD5
fdc31ac25c294a2915b3375704a0502f

SHA1
14bf82651fa8f2357a98d43e0b2b92da236a0a23

SHA256
455be42734fb0739d29806afe717c710cd07845480fbabcdee42fe8ae4aa8e25

SHA512
905700747f6ce0a1b2843ae7e8bbd6254b062a80f79f43427f551668d492e9979fd6f6651070948ec31427515019edbbdc0bd00cfe2012473218970c793f1cc6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
55KB

MD5
79d7056e9e71ae7867a40b780e90eb97

SHA1
f36a149187a6f323ba36074433a96a841875b14e

SHA256
9db76c023d83d87ae7aa8f31ed8e562290c2d434a19c8cc16a757150de4817a6

SHA512
f8ff333b826bf55d9f7e1104be660c7e4dbda9b079275cc192cec9bb44fd8836f0c14b871f62477bce16de69d793e6fae9e7d5092f95a5fbe862ce3330f4a350

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
56KB

MD5
cd4af183775d9a20284bdccbdd1c0457

SHA1
36315b1769ab4aacbf5ebd0767faa4a6b71705b8

SHA256
59f70f56f7bde510c386c098f9d1a833de27305876bedb8f0abfb52dc6be4783

SHA512
76b36e935232605c1a91b4150aeb122b77ea9bef5906876c531d97ada5cf04b3d1e6377cb1715c1ec3bd47a411081479e978493a926683102628b0bf652ac863

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
49KB

MD5
b6bc4198e8565d6792711cb1b4913b29

SHA1
782dda8251e3aad43034cab2867d5fda321007dc

SHA256
05a3a1d3bc9f1799323f579ebd33d29dc6859011c5d89671eca3a8ff2bcd0a0d

SHA512
1daf1c3bcc9db3ff1e25479eb4d66ab5a8a90c169316a087467f919d4b500fd4f322c1cb46c0af867f573d7554cf1548b0db86c68ce455a44fa111d3e848cc12

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
68KB

MD5
b02a26d3d54e097d621430553e769664

SHA1
0af2106e03ed2b9fd8dcb46eaa0ee64bca81c6af

SHA256
1a7416dbd85d18bcf020e4e036b1508af1012c84ca1524dfc38ac7820cd9144c

SHA512
635db782464f2b896d62ecd1563b3ac7debdc141b3e8330dec3de60da7589368f6895dc6bd07fda1ddf417730b05173041b0237817e3cbf78763c80aeb0881b7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
56KB

MD5
4ec20af538711a09e2e09adc3f964264

SHA1
f5d02507c495db89d3c947472a9c32d9f2778a82

SHA256
5375b4525621c286b2bae2952169aceffb6c00c33e3e598493cc8878fbeba675

SHA512
7aa3755833d33281166a5f0e2620f325f8400f8a65031043dd9d6b350d5a991f4d79d78efb6733fed8a449af52f28b7df1c490ca2afbf5f015e5a712f238b102

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
59KB

MD5
c1a1a8aa068d7f1048c3cea4ddf29517

SHA1
a8d964d718ddcb433a1eea0752681b7d02c26226

SHA256
c42c7d943cfda661ce8b69564ed824c9938b898a4a898260ca95316e6a0d1b66

SHA512
decd31c294e96094091df08ca1e120ab308533845e9cad447c97d9fc674d163ca6806881db61f45d1321cf4066db26bda3fae4f4456c71206530af9a857f6aee

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
62KB

MD5
449cc5d9444c630cc58f870fc61e09eb

SHA1
9428fbed150e0a4f6a4848ccc4aa2f0998fbae49

SHA256
7b60d813119d93b6fb75e90e071c2ba7f446750b1bb771da0cb49b7a282bf52d

SHA512
c5c033c071240f2c032bb86224e75f564c4639e487d8b5a165bc3e74da8db824df054afa6bf376b387dedae2534443afbecbf82eb8d3755df423ccad2715ed6d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
62KB

MD5
13875afdd772cb761468201bf663bb0e

SHA1
a3ec4ff4f66848fed588ebbe9b8d29517f337282

SHA256
54a0ba0f198f744908ad89330f8ebb111d042f11c685a3cee1c1ea7453c9e4ab

SHA512
114b5ac7c1497f10865d07375ea359ff47d36a8cb99989041c4ef2c69fac55ed87f101e7e27a690b4de1b8211916bc233e296f4f79058ba4b0e5803d57550150

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
67KB

MD5
b69f39dfa166e8fa7f65691cf257e713

SHA1
b0745a7602a4442934047f613a59f265295d1d4a

SHA256
361d9d5f586cba601e454fc8e932143867d5c8a25fe391e80745e8c83d414908

SHA512
6a40cee1b25a0bf61944e39d08d2d1911199b79bfa43ab941507e504bdea8d834a4daded47a83a2d89bdd6f607785408069ce40ff098b4165b8dbafd0fcb83bc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
66KB

MD5
9fe8a83fc3835606faa725764ff09091

SHA1
6e2517c4be8b8f30c77a641d1e9fd47a5487baae

SHA256
3c0a79dff35ef1d81351fa1d07617de3ced9574c44b4e0245813a8ab3e16be51

SHA512
1bc2f74cfb760f2c78821a886bf77bf24af5edf8178574a228aed799a40f7b1a4abfa28935b3bd80659b8356502a3defb04a099fe60cca5677e163a9de03be08

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
67KB

MD5
35b0a0fc257f347ad5efc90d0e445959

SHA1
25d43a8cb1b34b5b4c6570200e25f48cd1de4d00

SHA256
6b8edf49b8e8932462773d4e7f38ecc2c851c45328a19dc8b3ffe3e1589f7636

SHA512
a640eb48cfa24b82a792414b1f99efa9e6f30abe3457472b867619475174d55ebc626c92ff283bec056f3f460e95f6f16d95d846d50a2882452bfeb5849fe2a2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
68KB

MD5
261dc89d49925b573c534050b1736e12

SHA1
cdec629aa04144790328df4efcf60086eb0205f7

SHA256
d4df50fc43cd39de8da917ccd804f27c57fd649166eae3116502fcd2b2033b1d

SHA512
78f2e07f68056d116934f41053292bba2ad1bbdfce2c9fe830d028ffe16b2d92f94355d9225546aafd18e9ad9e814a79ff6f3aafc87a0ff06b3661d8ed951de3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
69KB

MD5
886e2b6ec30ec4bea1722c42d7b3dd0f

SHA1
1be31625af03bdb7ea5e440a54ad384056b86ef1

SHA256
0ad67f6a3dd4b510f99c199853f32319db4c8b5b746d32784b5e007aefb5ee39

SHA512
1f5c908114dc56d73737d2c947a04ef386831edbdb3d7280804f19641e7282e5e166b1736731581f5e7077083aeafc7fe078773b38c2dadc1aab698e86f49f5b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
67KB

MD5
fa3c9b755938c7538e318ee2cac3bf8b

SHA1
0a0777cdcfb3fecd9364f214310a7212a9fa7478

SHA256
623c14ef0f9b10aba94a6434369068f6d3bf67a1b46cefd902d2440a905bffbc

SHA512
4b99fd84a480d0d074829c0533fdb9ae6d6eec25027e81252c80e5442ebfca61619eadc28a95c6b7b6b34107d2826249d927acf29a0d8fe890890a423f86a999

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
73KB

MD5
da099a1e6cbb3938cf1eb3851b9885c4

SHA1
af98495ab3f1b5e18212b8f2d62f7365732e46f3

SHA256
aff8a0a572a37280e6d0cd72fc9052922843ab9ca5005f0a938e2e132ee7a4e6

SHA512
cf1761649cf0d9c77a73f9a9f79301ad98bccc4a6e4b1e2e6e44d51385cea8c2c244298082df0a6f5f58a3ba368115db81688e31d4bf9db08352e73daae1bd58

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
9KB

MD5
b998af70098d375b192627447b70da9f

SHA1
4ce4ee74c1827ebbaa02cf6cc609e3b1c0214e6c

SHA256
ddb3418313b218a55929c36e87b41e94100a1b4ec39e7424bb3f53a33a3cdb94

SHA512
47345be990581bb60d8cd867dd403550a63acf419ed6d51faa92b0acf6e2db3d43da4db3f610d7869a9115761226c6181a7e9a4a0b1b775ae36e78c9ed01c149

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
29ccdc3eea5689282672afe69cc6a0ff

SHA1
e84ff6ecda72687f77358dac02798128984a8791

SHA256
b51b3e4320e53ee4dd190dd9270312f2073a2416c1eb5c609b6604a8d05a0e1f

SHA512
93cb96a22d812b6c7d4183c77ea84ae177c9f7ba7cdf564242515d6e81e2b5a4b39cd363a9993e0f4e6b3ab15fc9d552259f3fa33ebc558ef9aff66a4f785b19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
11KB

MD5
1f3c3f5a13c25f94606d0c9576e79299

SHA1
76f22d8cb097d53b39946d03d9335bb666814018

SHA256
703c053d5f24f7d3b53c993666a57906eb039469d79c9ddb2c6e87f815db30de

SHA512
9d4479d7a340d9edd5482731226bcc782de5b5f4df2d9670cc54caf5532032d23210a3ed9b5d014045279db648c053c50a0fb70832bbe489df3ad75e6cb2102d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\sessionstore-backups\recovery.baklz4

Filesize
12KB

MD5
b50e44da7cca72080474f5635350e198

SHA1
7346d17ecfd16964f5607f266c52e5169af3426a

SHA256
b8e9e829323f2cd44ef717312edd8cd9636c2b09d30b3a206151ee7de7af64cc

SHA512
e17987ba410f32a907909093cab38ff6eb3c0ca40483ff1c54147e61942d21fbd8030e7a4dfe0abd454a261a0c4cab223193158cf1be76263a92cd53fac247ca

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\storage\default\https+++www.roblox.com\idb\3140325527hBbDa.sqlite

Filesize
48KB

MD5
a3312f8646349f24e5e0c2325fc7d64a

SHA1
0d0f1e40178aeb2cefb83812ad19f9b3bdcf1ac8

SHA256
f8a707907fb95655e1b9e6c85c4c98f09feb115baf9a7ae3a5a6aef748d35411

SHA512
f5bac5904fc57fb8c416f76c86c2ba6e4a80d4bb9804c2a1ffd7a07e7b5aba6781f1a43f7839c85bec225c2e3e7651f5dab98cc309acf904eb21aadf638582ab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\storage\default\https+++www.roblox.com\ls\usage

Filesize
12B

MD5
a3191adc3bc6a51cb1767d5f460c3443

SHA1
3e834b2d6c6892c63c4683fff595826e6c1ee29e

SHA256
07b3453e2b390a438965910155b06259238b2539983e0ceada44b44e850e6aa2

SHA512
5e0bb07b0125dbf921935da0cee8d2d5d52d02abf915481be6346d9f9c1b6118c2b25ee2280b6dfcd72d4afe950a96a1c86528981fac8fe0ab7a183fbb6b33fd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\storage\default\https+++www.roblox.com\ls\usage

Filesize
12B

MD5
e9e03e965cd28ccb222343e9ef079910

SHA1
3f1ef448791e785ed1626be49e399ce5c344326d

SHA256
0a1aa2d0869c2c890443d6a83d00c9d3f4b7b904cac259d0c667ae89e934c648

SHA512
1979fb92c9669ca6f9d0eb94d57a54fb9b04b9324cbac1832a5601d8e59a5db10fa8522de4bdc325d94aeb37571bd520b80596c17c053210df00107cb115fd9b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
584KB

MD5
c912aa6be8d247561d4049f3eb8c8cc4

SHA1
c2682590d6d32c1bd5b1090cec433a2ea12fdfc4

SHA256
a236e2ac18416908f4e1f774bb6d9be35997adcc256d0829cee88340586ef750

SHA512
228163a8df46b321c2b0120c027ef4911475b0c699f0d6eedbb0d10bd544e067626ce9e4b7c58dbc4e5bafd5351b9e4f2376418d49c9e203d538130ae83cc5c0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\odgo8eah.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
776KB

MD5
3936cdc1edd7b008c5814b2c4da147ef

SHA1
7582d2819f087aecce75dcb14894e4f252e1855a

SHA256
002051f55b108d3e679dc744f14c75b53e62a19ca69ef70f44afafa2a61786b6

SHA512
5821090ed9e4da3fe961e8aab1708864c27ff9a63e4af572c564ee11af9676987e6e0b5251fbec3c5e8257b467c63ea91f889c7857b242ffa717cd044f751acb

Download Submit
C:\Users\Admin\Downloads\7z2408-x64.exe

Filesize
1.5MB

MD5
0330d0bd7341a9afe5b6d161b1ff4aa1

SHA1
86918e72f2e43c9c664c246e62b41452d662fbf3

SHA256
67cb9d3452c9dd974b04f4a5fd842dbcba8184f2344ff72e3662d7cdb68b099b

SHA512
850382414d9d33eab134f8bd89dc99759f8d0459b7ad48bd9588405a3705aeb2cd727898529e3f71d9776a42e141c717e844e0b5c358818bbeac01d096907ad1

Download Submit
C:\Users\Admin\Downloads\7z2408-x64.exe:Zone.Identifier

Filesize
583B

MD5
eb54e6377deea76f5b64338c045bc165

SHA1
c5530181bc1678ad3c7f96363ef595aeead2ae58

SHA256
375adb65f012d3789eb3763d99c6ae66354985fbb37191679d959a851fbb4490

SHA512
b2c392d054aafd8f9f3b2aae15b74b925b818232dd3952eee3e25a0f5767cfcac4d9d235fae06217168a2754b23920b4a673469b48a712904c48420dab7349f3

Download Submit
C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!.daibmX6c.zip.part

Filesize
23.5MB

MD5
06457ab8a19ebd7e44b436462c939d99

SHA1
a3b019cfbb2b4025c2b93aae60c9db36e5506920

SHA256
6aae22d3e73c386cc7948a895c556cde0332adbb1d8640759bdac737529a166e

SHA512
8deb72a5134a5f669297fea6def0da061f8eaf056c037df038a03425cf89f71d356ffb56b0da5d0d05634e0f599ba77ed9db75c6d5af62ce36b6b5a07fd92f6b

Download Submit
C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!.7z

Filesize
23.5MB

MD5
7aa80aa6df4c4a0a0bdba7aa48655e36

SHA1
0be26b03e4f4a14a3d70e2b861a7de17fe98be9c

SHA256
e8d0cde03930349088133d292fb388df4880449d813eb8a4f77bad78b0d687ac

SHA512
0249fd470dd2818dd7893c75ab14ccab0fa261c808ae1482574f0eee5523f9fff3c255d1106e350818add6634df8764c210fce167ea834398cd38d2d6bb6cbb8

Download Submit
C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\Set-up.exe

Filesize
600KB

MD5
0e4d0427e2ef970138a24c0f3a6ec8df

SHA1
db4db31df946a2fe62a96b1772ad7c715e0c1fdd

SHA256
f9e187178a9e7c0ba13e0465aebbd446966393c09ea5930bea86dee9208c31d7

SHA512
961e32a36d596be6d9d1d1b8343350e59ca32a2120a3480cae2be4d0bf308c1107f88c12f037e21a2ee6fc8f49b551cb6eb4172e004bc6bc0cb136fb42a402ea

Download Submit
C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\boost_date_time.dll

Filesize
64KB

MD5
e4862728552671212c86b50470710beb

SHA1
ae6abe8d61fa9e16a07c5ed0b40980905e01faeb

SHA256
83a6ff307c32692f8775302315295e6a814701d5a617621c25b935cf9660d50f

SHA512
754e848815b831bb542414a4894ca4878fa2a9b748f94f611d840cef054bd3d1d3e839c2c4c650b52cb320c20e740423ee768fb951c1cfb2310b4c3f9ac7a099

Download Submit
C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\boost_system.dll

Filesize
22KB

MD5
cef0081a028fda210c1ad6417865cc95

SHA1
80b6c3b65ce5eadc8ee48bbb5609fe46c93caecb

SHA256
4f3a1c28b3a15e6fbb3ea635b2c43fea7de4a797543b5cf2142fe6b0240f2c5f

SHA512
fb65dab114a4eefa90a005d5c64b6e098495475a2d1daa6e0364257c7a15cd4201cb6445f4d843ce8c7e025b25f67d05dca53cbca2c18c5103d5e8b59654ff6e

Download Submit
C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\boost_threads.dll

Filesize
108KB

MD5
44d1d2711f5ff5c0d5a566beeed1fbe2

SHA1
db09ffacd3c5e55e561caa02e847b8714973cd2f

SHA256
882f809095a5a2b8be3c5a26d5882632d99b0622db904dca3ffcb48fd093d91c

SHA512
035b017a37aa8cfe7a8a59c39abee03553edb0a0f12a41c0820d0acf39bc99f7a2ef44c24778e37dfacbee209afdd6afa08067afcee7e1a1ef628f6473987f5e

Download Submit
C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\dvacore.dll

Filesize
2.5MB

MD5
35d25e3ab2c4b362ae162c6af3482b28

SHA1
0784fb8e2873218a6f6f3ac24cd9b24ce1b6beec

SHA256
e33f1d96f2905fb874ec52777afc3498231791426b7049e9ef61aedb9f782042

SHA512
5893e5b93e4cea89f4446d4ebe3705f3246f334c955ea5cf4ea26a339ff93a5b23fb9d8870a0c13532cc27b333236f45e914ed891c61704c3acaa4698cc8dfb6

Download Submit
C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\dvamarshal.dll

Filesize
264KB

MD5
4160806637a8913bd1917d00d1845018

SHA1
bab307c9f8725c2c3a4a031825e0e3a5e81de26c

SHA256
8b0828a82448079b9936a317775afaece313679241442ea4ebd1ca06be64d10d

SHA512
8dd9bb509623ae871f93cfcebd77781516d7ab6703dbee15aadc2fa5d3ffcab8b1305dc66df49cbd2e33b686b4346e119160735f04f6231b02ef4cb564371a51

Download Submit
C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\dvamediatypes.dll

Filesize
236KB

MD5
0641560e5ecd1702aa259ac8c48577e1

SHA1
f2832c5c37a66f6a559d00e3876f956ec75d5fbc

SHA256
3faa936558703316edbfb0d57d697f0ed160149b1417f4d5d02d9ef3576ff779

SHA512
7da8374e338be2c525b3f64c0a507e9c5aa1987ebd789334ac6980fa9e643692b021065a303f47f83716dc9b21de3bbc4f50af939d9c6b9561ddb3df9f65cfb9

Download Submit
C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\dvanet.dll

Filesize
13.7MB

MD5
89df889b54f628ced32d16f0ee11e437

SHA1
80354b1c15ab5bb30ac05771a508933a817510dd

SHA256
c14a85f1ead5beac4f4144e4648516ea86bce18f4855eadfb69d440fe3fca2e6

SHA512
84a8d34d0bc3ddf5d7c45708b3981afe8e2b7526df1675477750939d1b1c0572e78d64e06f1260196042b25fd75aa87146436719d67793c2b946730bc022f810

Download Submit
C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\dvatransport.dll

Filesize
554KB

MD5
c56cb2a849c920137088a6191d86c6bc

SHA1
37fde431edf78ee885719ce9bee3a07a399866c0

SHA256
5e12d3cf38ed4cac63129f421633e2e78548722ec3ed34b6463a6840db01a59f

SHA512
b8a7f5ba53dd972f554675d716ac00dd58cecdc69b853e9800842ff5f75d5b5745a39ffc91b3f66ebaeaab0ca68724c85dfee95e98bb056d30dbc4e245b8241f

Download Submit
C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\dynamiclink.dll

Filesize
2.2MB

MD5
d04de1f9538a6798c58fda391e8d7aa9

SHA1
583177a2749b40ec4421cc4beb421db559477a26

SHA256
a79ba9a61d9f4baff30d7fc00006b070c11bfda3e7ee6264af5a2be5b49c1d9c

SHA512
6a6b7a43a73a66624ee92620d426780157d70ea48b89c8f2d58b993388184d378fe528340c747390682049fb952b8b0602d7521aaff6a7a5853b194298bfcb0c

Download Submit
C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\jfikak

Filesize
787KB

MD5
fcf21a1cc77edd5f0bcb4208f87c58c7

SHA1
046278d29307086cb551ab7af48236f2c90edc78

SHA256
f572691497b1c979c7c2563207b8dd2ee0c314dab2875ea77e638c2e38509e89

SHA512
524b2d6c9c539628a920364322b9fc4b84b6cbc2e188e45051f45666939f6ba76534c20f6c275126c7d49b5a5e84d1a19a739af19ca76ee213178320188f2148

Download Submit
C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\kdyeb

Filesize
11KB

MD5
e86be6b95c8f617ebbd03ad8c74f1d6c

SHA1
b10c72b5355ca4bdb4fdab1fb21db75717293463

SHA256
76bc0a00d3a5fdcf97d8f5fc15c0bbb7418841308490f14c109731a20e3fbbd8

SHA512
b8c09445dd32a51bc8259119006ed58b40e089276c04461b9818ba168219688a9014a2a54b01e378e9077fc630d14552ab13ae7a382be10683e0ca9606bed6c3

Download Submit
C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\msvcp100.dll

Filesize
411KB

MD5
bc83108b18756547013ed443b8cdb31b

SHA1
79bcaad3714433e01c7f153b05b781f8d7cb318d

SHA256
b2ad109c15eaa92079582787b7772ba0a2f034f7d075907ff87028df0eaea671

SHA512
6e72b2d40e47567b3e506be474dafa7cacd0b53cd2c2d160c3b5384f2f461fc91bb5fdb614a351f628d4e516b3bbdabc2cc6d4cb4710970146d2938a687dd011

Download Submit
C:\Users\Admin\Downloads\@Pa$$w0rD__3971--0peɴ_SetUᴘ#!\msvcr100.dll

Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
C:\Users\Admin\Downloads\CheatEngine75.exe

Filesize
28.5MB

MD5
647a2177841aebe2f1bb1b3767f41287

SHA1
446575615e7fcc9c58fb04cad12909a183a2eb15

SHA256
07c1abb57c4498748c4f1344a786c2c136b82651786ed005d999ecbf6054fb2c

SHA512
f3165aec7a4b7adb7e6ffca56812f769b7b085000d50bf235ca1c7e74d76dfb5549de9561e281623c734c2dec9fc37b54af572c3e97fcb9fb1411102ae3da0c0

Download Submit
C:\Users\Admin\Downloads\CheatEngine75.exe:Zone.Identifier

Filesize
142B

MD5
efcb9f00efc53e051dc4a94035c08f19

SHA1
683250227d1a2223135e81e133ba31d0906cf74d

SHA256
543b1973aa2017b62370541b4a0f71e42ad4df064597bf0d75753f23f19b7a44

SHA512
b229d3fd864bb484bad24b315b166387c6e55812b08bafb27798d751c03dd4485a7116be500fabdb004d7d5546211a96a69182de817159284417545a3a6dbad9

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe

Filesize
6.9MB

MD5
1c4187f0b612a9a473010dcc37c37a82

SHA1
34d46733452812d481adeedad5eaea2cf4342540

SHA256
c8d55b0f4f25caf135dabc7f21b9548263022107e9740dfe692b402469cd47bd

SHA512
075678e24a867d5630da324e934837d81a3fa1d848a15feeb2a7be268d38b81ca4210cd44a22e9869173edebecd1947968327ddce16a85b71c03e6307e365def

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier

Filesize
148B

MD5
40878a4c7643db9ff656387ab494f82e

SHA1
4689319b8369b7be29540e6dc264cfda79b2755c

SHA256
59b1a57c08dbb511dd84c0c710da38cb0f641bd1305d3757f84cd8ab01fae746

SHA512
dff30aa75a391200f1cb753243b1d690d6ba6d41bf9f624fe86d19552ade2be11c258c51843c16989b61854211ba7cb1af4bd821da3fc0d02640066553bdf379

Download Submit
C:\Windows\Logs\PBR\ResetSession.xml

Filesize
7KB

MD5
b4249e8d712ea0ec9ccce184f3978310

SHA1
c77b90559c704dafcdf3f8ecf66281f413d5e75d

SHA256
db5db6b7c5a2accd54aad93acf1af1be6ea46f699fcd742973a57522d5f32032

SHA512
c28aea0e7dc1d4e324045a1bd7b9bf901ffc25edd9007f2e7b4b66886ccee49792764ce9e7b8ff9cdbd5dab060b8451d0afba920fe0d37c01e55c5b89b2bef7d

Download Submit
C:\Windows\Logs\PBR\SessionID.xml

Filesize
106B

MD5
ad90954dc95b63b721f6450f617809fd

SHA1
68a840f4ec538b6371c6b394c526ed2655018bd1

SHA256
57b37057df709ef5c779874d5151ced84fd4b0d0fa9aa3f9790ba1a93a60e22b

SHA512
2a4231f7203448ce07dfe8a6d23af2e7cbfedae8eee8683bbe4b5b1b57027664ef01271ba1b94c57fb13ff90425a7a93bb693fa0f2e199b20fc8502b0fded5a6

Download Submit
C:\Windows\Logs\PBR\WinRE\bootstat.dat

Filesize
66KB

MD5
668d82b83f8c52c0e5368a44b7eaa5a4

SHA1
069ec5b3f9ae609baafe6e59651dd361a9c6b33f

SHA256
106beb7dabcde632548e4e752c3c6222936ba8ddc2cf7e4864296070bd0553e1

SHA512
e475a3b75a9fbd00c80da10debf287cbfa06a7d583cbc886e42db81f9e0b32f2dc6c3676181d430699bfb2ffe0c71f5e40bd80836d5c2794840d7d1ab0d9b98d

Download Submit
C:\Windows\Panther\UnattendGC\diagwrn.xml

Filesize
14KB

MD5
bf6f37d1bd45128341ec33d015e43101

SHA1
554fa08efd26f8555fecbc893a978a3d1fdb2bee

SHA256
dee51de716918491ed1c7b1b39d1ef09f3b8267c2c271ca8371e5e504da4dc30

SHA512
630906f89acd7a006ac2b2393d74b206971f124a6c8bde12c4562eca71f26d8575f72ec81c08270774ff7a4755c2540f1e89b1d77984787a5f8649c0e19e1f7c

Download Submit
C:\Windows\System32\Recovery\ReAgent.xml

Filesize
1KB

MD5
313cc51cc5944ff3371cdab65ea2a0b8

SHA1
4cc257a58bec683cbc816569cc4fccde54bfb5bd

SHA256
c095dd97462fbdcbf73b84853114b9c10a97e84e645fafc3899f5a954a097494

SHA512
257469493410c5a06f4eab90eccb43d1d5916c6bb6d2e37c9fd054d9c4faab15ddf36e307f470f1f8e7f902e5ba4e0363dff5cd2c05126d09a18e25005ea380a

Download Submit
C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
3d6795b1c3a162d548a09b66e0b28304

SHA1
89f520da4dd0a9c0345d76e37c14a4085b52b913

SHA256
2dd69f3329ceaac52e2a4931db3b74f341252df01e937bd45dbd58df20abc337

SHA512
c75b768438d5c7a68ddc916e58bfa670b7bf1a7138793e0481b7e7fed1b84c99922736059064d806041034f1267527c1daa5469c40f2c7f3107d866c696b1d41

Download Submit
memory/1824-2243-0x0000000004420000-0x0000000004560000-memory.dmp

Filesize
1.2MB

Download
memory/1824-2248-0x0000000004420000-0x0000000004560000-memory.dmp

Filesize
1.2MB

Download
memory/1824-2272-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/2268-1529-0x00007FFDD7EE0000-0x00007FFDD80E9000-memory.dmp

Filesize
2.0MB

Download
memory/2268-1532-0x00000000752F0000-0x000000007546D000-memory.dmp

Filesize
1.5MB

Download
memory/3432-1477-0x0000000000CC0000-0x0000000000D04000-memory.dmp

Filesize
272KB

Download
memory/3432-1505-0x0000000002910000-0x0000000002911000-memory.dmp

Filesize
4KB

Download
memory/3432-1502-0x00000000028B0000-0x00000000028ED000-memory.dmp

Filesize
244KB

Download
memory/3432-1500-0x0000000002870000-0x0000000002882000-memory.dmp

Filesize
72KB

Download
memory/3432-1495-0x0000000002820000-0x000000000283D000-memory.dmp

Filesize
116KB

Download
memory/3432-1486-0x0000000002630000-0x00000000026BC000-memory.dmp

Filesize
560KB

Download
memory/3432-1484-0x00000000023E0000-0x0000000002619000-memory.dmp

Filesize
2.2MB

Download
memory/3432-1526-0x00000000752F0000-0x000000007546D000-memory.dmp

Filesize
1.5MB

Download
memory/3432-1481-0x0000000000A30000-0x0000000000CB7000-memory.dmp

Filesize
2.5MB

Download
memory/3432-1511-0x00000000752F0000-0x000000007546D000-memory.dmp

Filesize
1.5MB

Download
memory/3432-1512-0x00007FFDD7EE0000-0x00007FFDD80E9000-memory.dmp

Filesize
2.0MB

Download
memory/3432-1508-0x0000000000D10000-0x00000000023C6000-memory.dmp

Filesize
22.7MB

Download
memory/4056-2276-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4488-1588-0x00007FFDD7EE0000-0x00007FFDD80E9000-memory.dmp

Filesize
2.0MB

Download
memory/4488-1591-0x0000000000150000-0x00000000001AC000-memory.dmp

Filesize
368KB

Download
memory/4488-1592-0x0000000000E80000-0x0000000000EA8000-memory.dmp

Filesize
160KB

Download
memory/5508-1589-0x00000000752F0000-0x000000007546D000-memory.dmp

Filesize
1.5MB

Download
memory/5508-1573-0x00000000752F0000-0x000000007546D000-memory.dmp

Filesize
1.5MB

Download
memory/5508-1554-0x0000000000CB0000-0x0000000000D3C000-memory.dmp

Filesize
560KB

Download
memory/5508-1570-0x0000000001020000-0x00000000026D6000-memory.dmp

Filesize
22.7MB

Download
memory/5508-1557-0x0000000000D50000-0x0000000000D94000-memory.dmp

Filesize
272KB

Download
memory/5508-1559-0x0000000000A20000-0x0000000000CA7000-memory.dmp

Filesize
2.5MB

Download
memory/5508-1561-0x0000000000DB0000-0x0000000000FE9000-memory.dmp

Filesize
2.2MB

Download
memory/5508-1569-0x0000000002900000-0x0000000002901000-memory.dmp

Filesize
4KB

Download
memory/5508-1574-0x00007FFDD7EE0000-0x00007FFDD80E9000-memory.dmp

Filesize
2.0MB

Download
memory/5508-1567-0x0000000002880000-0x00000000028BD000-memory.dmp

Filesize
244KB

Download
memory/5508-1565-0x0000000002850000-0x000000000286D000-memory.dmp

Filesize
116KB

Download
memory/5508-1563-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/5692-2221-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/5692-2271-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/5720-1593-0x00007FFDD7EE0000-0x00007FFDD80E9000-memory.dmp

Filesize
2.0MB

Download
memory/5848-2007-0x0000000000460000-0x00000000004BC000-memory.dmp

Filesize
368KB

Download
memory/5848-2006-0x00007FFDD7EE0000-0x00007FFDD80E9000-memory.dmp

Filesize
2.0MB

Download
memory/5848-2008-0x0000000000E80000-0x0000000000EA8000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads